CVE-2026-32420

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32420", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-03-12T11:11:26.570Z", "datePublished": "2026-03-13T11:42:16.126Z", "dateUpdated": "2026-04-29T09:51:58.994Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "gamipress", "product": "GamiPress", "vendor": "Ruben Garcia", "versions": [{"changes": [{"at": "7.6.7", "status": "unaffected"}], "lessThanOrEqual": "7.6.6", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "letchupkt | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:06:16.752Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Ruben Garcia GamiPress gamipress allows Cross Site Request Forgery.<p>This issue affects GamiPress: from n/a through <= 7.6.6.</p>"}], "value": "Cross-Site Request Forgery (CSRF) vulnerability in Ruben Garcia GamiPress gamipress allows Cross Site Request Forgery.This issue affects GamiPress: from n/a through <= 7.6.6."}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "Cross Site Request Forgery"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-29T09:51:58.994Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/gamipress/vulnerability/wordpress-gamipress-plugin-7-6-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"}], "title": "WordPress GamiPress plugin <= 7.6.6 - Cross Site Request Forgery (CSRF) vulnerability"}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T18:09:51.854858Z", "id": "CVE-2026-32420", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T18:10:20.502Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-32420", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T18:09:51.854858Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T18:09:07.575Z"}}], "cna": {"title": "WordPress GamiPress plugin <= 7.6.6 - Cross Site Request Forgery (CSRF) vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "letchupkt | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "Cross Site Request Forgery"}]}], "affected": [{"vendor": "Ruben Garcia", "product": "GamiPress", "versions": [{"status": "affected", "changes": [{"at": "7.6.7", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "7.6.6"}], "packageName": "gamipress", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-01T16:06:16.752Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/gamipress/vulnerability/wordpress-gamipress-plugin-7-6-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Ruben Garcia GamiPress gamipress allows Cross Site Request Forgery.This issue affects GamiPress: from n/a through <= 7.6.6.", "supportingMedia": [{"type": "text/html", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Ruben Garcia GamiPress gamipress allows Cross Site Request Forgery.<p>This issue affects GamiPress: from n/a through <= 7.6.6.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-01T14:16:13.723Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32420", "state": "PUBLISHED", "dateUpdated": "2026-04-01T14:16:13.723Z", "dateReserved": "2026-03-12T11:11:26.570Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-13T11:42:16.126Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "gamipress", "product": "GamiPress", "vendor": "Ruben Garcia", "versions": [{"changes": [{"at": "7.6.7", "status": "unaffected"}], "lessThanOrEqual": "7.6.6", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Ruben Garcia GamiPress gamipress allows Cross Site Request Forgery.This issue affects GamiPress: from n/a through <= 7.6.6."}, {"lang": "es", "value": "Vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en Ruben Garcia GamiPress gamipress permite la falsificaci\u00f3n de petici\u00f3n en sitios cruzados. Este problema afecta a GamiPress: desde n/d hasta &lt;= 7.6.6."}], "id": "CVE-2026-32420", "lastModified": "2026-06-17T10:35:47.030", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "audit@patchstack.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32420", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T18:09:51.854858Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:54:59.697", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/gamipress/vulnerability/wordpress-gamipress-plugin-7-6-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.6.6]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.6.7,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "GamiPress", "source": "cna", "vendor": "Ruben Garcia"}, "product": "gamipress", "vendor": "ruben_garcia"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-19T15:19:02.195122+00:00", "value": {"mitigation_remediation": ["Update GamiPress to a version newer than 7.6.6.", "If an immediate update is not possible, apply a temporary CSRF mitigation by ensuring all form submissions include a reliable anti\u2011CSRF token and that sensitive actions are protected by user authentication and permission checks."], "summary": {"action": "Patch", "impact": "Cross\u2011Site Request Forgery (CSRF)"}, "threat_synthesis": {"affected_systems": "The affected product is the GamiPress plugin for WordPress, developed by Ruben Garcia. All versions of the plugin from the earliest releases up to and including 7.6.6 are affected. WordPress sites that have not updated the plugin beyond version 7.6.6 are at risk.", "description_and_impact": "The vulnerability is a Cross\u2011Site Request Forgery flaw in the GamiPress WordPress plugin. It allows an attacker to trick a legitimate user into executing unwanted actions within the plugin that the user\u2019s browser is authenticated to. The impact is that the attacker can perform privileged operations such as awarding points, adding badges, or modifying the user\u2019s account settings without the user\u2019s consent. This weakness is identified as CWE-352, indicating an attacker can exploit the lack of CSRF protection to gain unauthorized use of functionalities that rely on authenticated sessions.", "risk_and_exploitability": "The CVSS score of 5.4 indicates moderate severity. The EPSS score is less than 1%, implying low current exploitation probability. The vulnerability is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog, which suggests no known public exploitation yet. Likely attack vectors involve a malicious link or email that forces the user\u2019s browser to submit a forged request to the GamiPress endpoint. An attacker would need a user with sufficient privileges or an authenticated session to succeed, but the lack of CSRF tokens permits the forgery."}}}}, "created": "2026-03-16T09:33:52.067487+00:00", "updated": "2026-03-23T12:03:44.024470+00:00", "vendors": ["ruben_garcia", "ruben_garcia$PRODUCT$gamipress", "wordpress", "wordpress$PRODUCT$wordpress"]}