What is the CVSS score of CVE-2026-65512?

CVE-2026-65512 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

WP Activity Log CVE-2026-65512

EUVD-2026-48118 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-23 Patchstack

GHSA-v4g8-h68m-rjcm

WordPress CSRF Wp Activity Log Wordpress Plugin Melapress

5.4

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

Attacker needs no privileges (PR:N); victim must be an authenticated admin visiting a crafted page (UI:R); impact confined to partial integrity and availability of plugin data with no confidentiality exposure.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:15 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in WP Activity Log <= 5.6.4 versions.

AnalysisAI

Cross-Site Request Forgery in WP Activity Log (WordPress plugin by Melapress, versions ≤ 5.6.4) enables unauthenticated remote attackers to perform unauthorized state-changing actions against the plugin by tricking an authenticated administrator into visiting a crafted page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) confirms network-reachable exploitation with no attacker privileges required, resulting in limited integrity and availability impact - notably, an attacker could forge requests to disable or clear activity logs, undermining the plugin's core security audit function. No public exploit or active exploitation has been identified at time of analysis.

Technical ContextAI

WP Activity Log is a widely-used WordPress plugin by Melapress (CPE: cpe:2.3:a:melapress:wp_activity_log:*:*:*:*:*:*:*:*) designed to track and audit user activity across WordPress installations. CWE-352 (Cross-Site Request Forgery) arises when the plugin fails to validate WordPress nonces or anti-forgery tokens on state-changing administrative requests. Because browsers automatically attach session cookies to cross-origin requests, an attacker can craft a malicious HTML page containing hidden forms or auto-submitting scripts that issue forged requests to the WordPress wp-admin interface on behalf of a logged-in administrator. The plugin's role as a security audit trail makes CSRF particularly impactful here - successful forgery could be used to suppress or erase evidence of other malicious activity.

RemediationAI

Upgrade WP Activity Log to the latest available version beyond 5.6.4 via the WordPress plugin repository or the vendor's official channel; the exact patched version number is not independently confirmed in the available intelligence data and should be verified against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-security-audit-log/vulnerability/wordpress-wp-activity-log-plugin-5-6-4-cross-site-request-forgery-csrf-vulnerability or the WordPress.org plugin changelog. If immediate upgrade is not feasible, administrators should avoid clicking links from untrusted or unsolicited sources while authenticated to the WordPress dashboard, and consider implementing a web application firewall rule blocking cross-origin POST requests to wp-admin endpoints as a compensating control (note: aggressive WAF rules may break legitimate third-party integrations and should be tested before deployment). Ensuring WordPress administrator sessions are short-lived and enforcing re-authentication for sensitive actions also reduces exposure.