CVE-2023-2286: CSRF
First published: Fri Jun 09 2023(Updated: )
The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajax_run_cleanup function. This makes it possible for unauthenticated attackers to invoke this function via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Melapress WP Activity Log | <=4.5.0 | |
| Melapress WP Activity Log | <=4.5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://plugins.trac.wordpress.org/browser/wp-security-audit-log/trunk/classes/Views/Settings.php#L278
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2911239%40wp-security-audit-log%2Ftrunk&old=2897171%40wp-security-audit-log%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e2008e0b-32c6-46fb-93b9-2b0004f478e8?source=cve
Frequently Asked Questions
What is the vulnerability ID for WP Activity Log for WordPress?
The vulnerability ID for WP Activity Log for WordPress is CVE-2023-2286.
What is the severity of CVE-2023-2286?
The severity of CVE-2023-2286 is medium with a score of 4.3.
How does the WP Activity Log for WordPress vulnerability occur?
The WP Activity Log for WordPress vulnerability occurs due to missing or incorrect nonce validation on the ajax_run_cleanup function.
What software versions are affected by CVE-2023-2286?
Versions up to and including 4.5.0 of WP Activity Log for WordPress are affected by CVE-2023-2286.
How can unauthenticated attackers exploit CVE-2023-2286?
Unauthenticated attackers can exploit CVE-2023-2286 by invoking the ajax_run_cleanup function via a forged request.
Are there any references for CVE-2023-2286?
Yes, there are references available for CVE-2023-2286. They can be found at the following URLs: [Reference 1](https://plugins.trac.wordpress.org/browser/wp-security-audit-log/trunk/classes/Views/Settings.php#L278), [Reference 2](https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2911239%40wp-security-audit-log%2Ftrunk&old=2897171%40wp-security-audit-log%2Ftrunk&sfp_email=&sfph_mail=), [Reference 3](https://www.wordfence.com/threat-intel/vulnerabilities/id/e2008e0b-32c6-46fb-93b9-2b0004f478e8?source=cve).
What is the CWE ID of CVE-2023-2286?
The CWE ID of CVE-2023-2286 is 352.
- agent/type
- agent/softwarecombine
- agent/remedy
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/wpwhitesecurity
- canonical/melapress wp activity log
- version/melapress wp activity log/4.5.0