What is the CVSS score of EUVD-2026-89822?

EUVD-2026-89822 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of WP Activity Log are affected by EUVD-2026-89822?

A high-severity SQL injection flaw affects the WP Activity Log WordPress plugin through version 5.6.6, the tool many organizations rely on to audit user and content activity across their WordPress…

How to fix or mitigate EUVD-2026-89822?

Within 24 hours, inventory every WordPress installation running WP Activity Log at version 5.6.6 or earlier, prioritizing internet-facing sites; restrict and review the list of WordPress administrator accounts, enforce least privilege by downgrading non-essential admins, require MFA for all admin logins, and increase monitoring of admin-authenticated requests to plugin endpoints for anomalous SQL-like parameters. Within 7 days, if the plugin is not business-critical, deactivate and remove WP Activity Log 5.6.6 and earlier and replace it with an alternative activity-logging solution; where the plugin must remain, apply virtual patching or WAF rules that block SQL metacharacters and unexpected query patterns against the plugin's admin endpoints, tighten file and database permissions, and confirm that audit logs are shipped off-host so tampering is detectable. Within 30 days, track the vendor advisory at wordpress.org for a fixed release and test and deploy it as soon as an exact fix version is published, rotate database and WordPress administrator credentials as a precaution, conduct a targeted review of database and log access for indicators of abuse, and update the vulnerability management process to flag admin-only plugin flaws in the third-party WordPress estate with equivalent urgency.

WP Activity Log EUVD-2026-89822

| CVE-2026-62085 HIGH

SQL Injection (CWE-89)

2026-09-30 Patchstack

GHSA-fgf6-78c3-qf35

PHP WordPress SQLi Wp Activity Log Wordpress Plugin Melapress

7.6

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

6.0 MEDIUM

Network SQLi with low complexity but administrator-only (PR:H); confidentiality high via DB read, with minor integrity/availability effects; scope unchanged as impact stays within the WordPress DB authority.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Metadata Corrected

Sep 30, 2026 - 13:40 vuln.today

tag: PHP added

Analysis Generated

Sep 30, 2026 - 13:16 vuln.today

CVE Published

Sep 30, 2026 - 12:26 cve.org

HIGH 7.6

DescriptionCVE.org

Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.

AnalysisAI

SQL injection in WP Activity Log 5.6.6 and earlier allows an authenticated WordPress administrator to inject SQL through an admin-accessible plugin function, potentially reading sensitive database contents and causing limited integrity or availability impact. The vulnerability requires a high-privileged admin account per the PR:H vector, so it is not exploitable by unauthenticated visitors or lower-privileged users; no public exploit code was identified at time of analysis. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires an authenticated WordPress administrator account on a site running WP Activity Log (Melapress, formerly WP Security Audit Log) version 5.6.6 or earlier; the injection is reached through an administrator-accessible plugin function. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, base 7.6) describes a network-exploitable, low-complexity SQL injection requiring high privileges (PR:H) with no user interaction, a changed scope (S:C), and high confidentiality but no integrity and only low availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No exact vendor-fixed version is provided in the supplied intelligence; administrators should consult the Patchstack advisory and Melapress release notes for a patched WP Activity Log release and upgrade immediately once a fixed version is identified. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory every WordPress installation running WP Activity Log at version 5.6.6 or earlier, prioritizing internet-facing sites; restrict and review the list of WordPress administrator accounts, enforce least privilege by downgrading non-essential admins, require MFA for all admin logins, and increase monitoring of admin-authenticated requests to plugin endpoints for anomalous SQL-like parameters. …

Threat intelligence, references, and detailed analysis are available after sign-in.