CVE-2023-4269

MEDIUM

4.3

Description

The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated users, such as subscriber to perform such action and retrieve PII such as email addresses.

CVE Details

CVSS v3.1 Score4.3

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published9/4/2023

Last Modified4/23/2025

Sourcenvd

Honeypot Sightings0

Affected Products

solwininfotech:user_activity_log

Weaknesses (CWE)

CWE-863

References

https://wpscan.com/vulnerability/db3e4336-117c-47f2-9b43-2ca115525297(contact@wpscan.com)

https://wpscan.com/vulnerability/db3e4336-117c-47f2-9b43-2ca115525297(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.