Skip to content
Sign in
7.3 High

CVE-2020-36716 The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on…

Description

The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the setup_page function in versions up to, and including, 4.0.1. This makes it possible for unauthenticated attackers to run the setup wizard (if it has not been run previously) and access plugin configuration options.

Affected products and versions

Product Affected versions Fixed in
WP Activity Log 4.0 earliest → < 4.0.2 4.0.2
WP Activity Log 4.0 earliest → < 4.0.2 4.0.2

Other CVEs of WP Activity Log

The 3 CVEs of WP Activity Log →
CVE-2023-2261 The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on… 4.3 Medium CVE-2023-2286 The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0 4.3 Medium
Track this CVE