Vulnerability · Published Sep 4, 2023 · Assigned by WPScan
CVE-2023-4269User Activity Log < 1.6.6 - Subscriber+ Log Export
Medium 4.3
In plain English
A medium-severity security flaw in User Activity Log from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.5%top 55.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated users, such as subscriber to perform such action and retrieve PII such as email addresses.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | User Activity Log | 0 – before 1.6.6 |
References
- https://wpscan.com/vulnerability/db3e4336-117c-47f2-9b43-2ca115525297 exploit, vdb-entry, technical-description