{"id":"CVE-2026-107320","state":"PUBLISHED","title":"GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure","description":"The GamiPress  WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450.","publishedAt":"2026-10-14T06:00:11.595Z","updatedAt":"2026-10-14T13:42:22.621Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown GamiPress"],"affected":[{"vendor":"Unknown","product":"GamiPress","defaultStatus":"unaffected","versions":[{"version":"7.9.5","status":"affected","lessThan":"8.0.6","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/034edcec-6aee-481c-8550-6762ab96725f/"],"weaknesses":["CWE-200"],"ingestedAt":"2026-10-29T20:10:23.711Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/107xxx/CVE-2026-107320.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-107320","state":"PUBLISHED","datePublished":"2026-10-14T06:00:11.595Z","dateUpdated":"2026-10-14T13:42:22.621Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-10-07T17:33:42.641Z"},"containers":{"cna":{"title":"GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure","descriptions":[{"lang":"en","value":"The GamiPress  WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450."}],"affected":[{"vendor":"Unknown","product":"GamiPress","defaultStatus":"unaffected","versions":[{"version":"7.9.5","status":"affected","lessThan":"8.0.6","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/034edcec-6aee-481c-8550-6762ab96725f/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-200 Information Exposure","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-10-14T06:00:11.595Z"},"credits":[{"lang":"en","value":"Usama Arshad","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-107320","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-14T13:29:27.784196Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","lang":"en","type":"CWE","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-14T13:42:22.621Z"}}]}}}