CVE-2023-2286
published 2023-06-09CVE-2023-2286: The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect…
PriorityP416medium4.3CVSS 3.1
AVNACLPRNUIRSUCNILAN
EPSS
0.30%
22.4th percentile
The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajax_run_cleanup function. This makes it possible for unauthenticated attackers to invoke this function via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| melapress | wp_activity_log | <= 4.5.0 | — |
| wpwhitesecurity | wp_activity_log | <= 4.5.0 | — |
| wpwhitesecurity | wp_activity_log_premium | <= 4.5.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
WP Activity Log Plugin up to 4.5.0 on WordPress ajax_run_cleanup cross-site request forgery
vuldb·2026-04-10·CVSS 4.3
CVE-2023-2286 [MEDIUM] WP Activity Log Plugin up to 4.5.0 on WordPress ajax_run_cleanup cross-site request forgery
A vulnerability classified as problematic was found in WP Activity Log Plugin up to 4.5.0 on WordPress. This impacts the function ajax_run_cleanup. Executing a manipulation can lead to cross-site request forgery.
This vulnerability appears as CVE-2023-2286. The attack may be performed from remote. There is no available exploit.
GHSA
GHSA-jcw3-2wgr-7692: The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4
ghsa_unreviewed·2023-06-09
CVE-2023-2286 [MEDIUM] CWE-352 GHSA-jcw3-2wgr-7692: The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4
The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajax_run_cleanup function. This makes it possible for unauthenticated attackers to invoke this function via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://plugins.trac.wordpress.org/browser/wp-security-audit-log/trunk/classes/Views/Settings.php#L278https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2911239%40wp-security-audit-log%2Ftrunk&old=2897171%40wp-security-audit-log%2Ftrunk&sfp_email=&sfph_mail=https://www.wordfence.com/threat-intel/vulnerabilities/id/e2008e0b-32c6-46fb-93b9-2b0004f478e8?source=cvehttps://plugins.trac.wordpress.org/browser/wp-security-audit-log/trunk/classes/Views/Settings.php#L278https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2911239%40wp-security-audit-log%2Ftrunk&old=2897171%40wp-security-audit-log%2Ftrunk&sfp_email=&sfph_mail=https://www.wordfence.com/threat-intel/vulnerabilities/id/e2008e0b-32c6-46fb-93b9-2b0004f478e8?source=cve
2023-06-09
Published