EUVD-2026-48118
GHSA-v4g8-h68m-rjcm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Attacker needs no privileges (PR:N); victim must be an authenticated admin visiting a crafted page (UI:R); impact confined to partial integrity and availability of plugin data with no confidentiality exposure.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Request Forgery (CSRF) in WP Activity Log <= 5.6.4 versions.
AnalysisAI
Cross-Site Request Forgery in WP Activity Log (WordPress plugin by Melapress, versions ≤ 5.6.4) enables unauthenticated remote attackers to perform unauthorized state-changing actions against the plugin by tricking an authenticated administrator into visiting a crafted page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) confirms network-reachable exploitation with no attacker privileges required, resulting in limited integrity and availability impact - notably, an attacker could forge requests to disable or clear activity logs, undermining the plugin's core security audit function. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must be an authenticated WordPress administrator (or a user with sufficient privileges to manage WP Activity Log settings) who is actively logged into their WordPress installation at the time of exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 Medium score is consistent with a network-reachable CSRF (AV:N/AC:L) that requires no attacker privileges (PR:N) but mandates victim interaction (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious webpage containing a hidden auto-submitting HTML form that targets a WP Activity Log administrative endpoint on the victim's WordPress site. The attacker delivers this page to a WordPress administrator via a phishing email or a compromised third-party site; when the admin loads the page in their browser while their WordPress session is active, the browser silently submits the forged request with the admin's session cookies, potentially disabling logging or altering plugin configuration without any visible indication. … |
| Remediation | Upgrade WP Activity Log to the latest available version beyond 5.6.4 via the WordPress plugin repository or the vendor's official channel; the exact patched version number is not independently confirmed in the available intelligence data and should be verified against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-security-audit-log/vulnerability/wordpress-wp-activity-log-plugin-5-6-4-cross-site-request-forgery-csrf-vulnerability or the WordPress.org plugin changelog. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Activity Log
View allThe WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the
Unauthenticated PHP object injection in the WP Activity Log WordPress plugin versions 5.6.3.1 and earlier allows remote
The WP Activity Log Premium plugin for WordPress is vulnerable to SQL Injection via the entry->roles parameter in all ve
The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all
Stored/reflected Cross-Site Scripting in Melapress's WP Activity Log WordPress plugin (versions <= 5.6.3.1, reported by
DOM-Based Cross-Site Scripting in Melapress WP Activity Log (all versions through 5.6.3) allows a low-privileged, authen
WP Activity Log 5.3.2 was found to be vulnerable. Rated medium severity (CVSS 6.3), this vulnerability is remotely explo
The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all v
The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the
The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. R
The WP Activity Log Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing cap
The WP Activity Log Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and incl
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today