What is the CVSS score of EUVD-2026-29901?

EUVD-2026-29901 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of coreActivity WordPress plugin are affected by EUVD-2026-29901?

The coreActivity plugin (versions ≤3.0) contains a PHP object injection vulnerability allowing unauthenticated attackers to deny administrator access to log pages by injecting malicious payloads…

How to fix or mitigate EUVD-2026-29901?

Within 24 hours: identify all WordPress instances running coreActivity ≤3.0 and disable the plugin or restrict log page access via web application firewall rules blocking requests to /wp-admin/admin.php?page=coreactivity-logs. Within 7 days: update to coreActivity version 3.1 or later (vendor-released patch available as of May 6, 2026). Within 30 days: conduct administrative log review to identify any injected payloads and verify no unauthorized access occurred during the patching window.

coreActivity WordPress plugin EUVD-2026-29901

| CVE-2026-7635 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-05-13 Wordfence

Denial Of Service PHP WordPress Deserialization

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

May 13, 2026 - 05:30 vuln.today

Analysis Generated

May 13, 2026 - 05:30 vuln.today

CVE Published

May 13, 2026 - 04:26 nvd

HIGH 8.1

DescriptionCVE.org

The coreActivity: Activity Logging for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0. This is due to the plugin failing to validate or strip PHP serialization syntax from the User-Agent HTTP header before storing it in the logmeta table, and subsequently calling maybe_unserialize() on every retrieved meta_value in query_metas() without verifying the data was originally serialized by the application. This makes it possible for unauthenticated attackers to inject a crafted PHP serialized payload via the User-Agent header during any logged event (such as a failed login attempt), which, when an administrator views the Logs page, is deserialized and passed to DeviceDetector::setUserAgent(), triggering a Fatal TypeError that creates a persistent Denial of Service condition blocking administrator access to the Logs page entirely.

AnalysisAI

PHP Object Injection vulnerability in coreActivity activity logging plugin through version 3.0 allows remote attackers to trigger persistent Denial of Service blocking administrator access to log pages. Unauthenticated attackers inject crafted PHP serialized payloads via User-Agent headers during any logged event (e.g., failed login). When administrators view the Logs page, the plugin deserializes untrusted data and passes it to DeviceDetector::setUserAgent(), causing Fatal TypeError. Vendor-released patch version 3.1 available (released May 6, 2026). EPSS exploitation probability not available; no CISA KEV listing at time of analysis. CVSS 8.1 reflects high complexity attack requiring precise payload crafting despite no authentication requirement.

Technical ContextAI

This vulnerability exploits PHP's unsafe deserialization mechanism combined with WordPress plugin event logging. The coreActivity plugin stores User-Agent HTTP headers directly into the logmeta database table without sanitizing PHP serialization syntax (e.g., 'O:' object notation). The DBLite.php query_metas() method subsequently calls maybe_unserialize() on every retrieved meta_value field without validating whether the data was originally serialized by the application itself, violating CWE-502 (Deserialization of Untrusted Data). When an administrator accesses the Logs page, the Table.php list table renderer deserializes the poisoned User-Agent string and passes it to the third-party DeviceDetector library's setUserAgent() method, which expects a string but receives a malformed PHP object, triggering Fatal TypeError. The affected product is cpe:2.3:a:gdragon:coreactivity:activity_logging_for_wordpress versions up to and including 3.0. This pattern is common in WordPress plugins that log HTTP headers to database tables and later display them in admin interfaces without proper input validation and output encoding.

RemediationAI

Upgrade to coreActivity plugin version 3.1 or later, released May 6, 2026, which implements input sanitization of user_agent values before database storage and controls display of user agent values per GitHub PR #3 commit 1f09331d66de7cf4bba9b6e396b0d4e7597fcde2 visible at https://github.com/dev4press/coreactivity/pull/3/changes/1f09331d66de7cf4bba9b6e396b0d4e7597fcde2. The patch sanitizes User-Agent headers on input and adds validation to prevent deserialization of untrusted data. If immediate upgrade is not feasible, implement compensating controls: (1) disable or uninstall coreActivity plugin until patched version can be deployed, trading activity logging capability for elimination of attack surface; (2) restrict wp-admin access to trusted IP addresses via web server configuration or WordPress security plugin, reducing likelihood of malicious User-Agent injection during failed logins (note this does not prevent authenticated users from injecting payloads via legitimate logged events); (3) implement Web Application Firewall rules to block HTTP requests containing PHP serialization syntax in User-Agent header (regex pattern matching 'O:[0-9]+:' or 'a:[0-9]+:{'), though sophisticated attackers may evade signature-based detection via encoding. WordPress administrators should verify plugin version via Plugins admin page and consult vendor documentation at https://www.wordfence.com/threat-intel/vulnerabilities/id/59f30135-6dd9-4367-90a9-a10ad491357d for additional guidance.