CVE-2023-2261
First published: Fri Jun 09 2023(Updated: )
The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_ajax_call function in versions up to, and including, 4.5.0. This makes it possible for authenticated attackers, with subscriber-level access or higher, to obtain a list of users with accounts on the site. This includes ids, usernames and emails.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Melapress WP Activity Log | <=4.5.0 | |
| Melapress WP Activity Log | <=4.5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://plugins.trac.wordpress.org/browser/wp-security-audit-log/trunk/vendor/wpwhitesecurity/select2-wpwhitesecurity/load.php#L70
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2911239%40wp-security-audit-log%2Ftrunk&old=2897171%40wp-security-audit-log%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f51f0919-498e-4f86-a933-1b7f2c4a10a4?source=cve
Frequently Asked Questions
What is CVE-2023-2261?
CVE-2023-2261 is a vulnerability in the WP Activity Log plugin for WordPress that allows authenticated attackers to bypass authorization and obtain a list of users.
How does CVE-2023-2261 impact the WP Activity Log plugin?
CVE-2023-2261 allows authenticated attackers with subscriber-level access or higher to bypass authorization and view a list of users.
What is the severity of CVE-2023-2261?
CVE-2023-2261 has a severity rating of 4.3 (medium).
How can I fix CVE-2023-2261?
To fix CVE-2023-2261, update the WP Activity Log plugin to version 4.5.1 or later.
Where can I find more information about CVE-2023-2261?
You can find more information about CVE-2023-2261 on the Wordfence website and the official WordPress plugin repository.
- agent/type
- agent/softwarecombine
- agent/severity
- agent/author
- agent/references
- agent/remedy
- agent/weakness
- agent/first-publish-date
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/wpwhitesecurity
- canonical/melapress wp activity log
- version/melapress wp activity log/4.5.0