Is CVE-2026-77764 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-77764

Description

The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them without limit.