CVE-2023-4269

User Activity Log < 1.6.6 - Subscriber+ Log Export

Medium · published September 4, 2023

CVSS v3.1
4.3
EPSS
1%
Percentile
43.4
In the wild
Unconfirmed
What it is

The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated users, such as subscriber to perform such action and retrieve PII such as email addresses.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00521 · 43.4th percentile
Published
2023-09-04T11:26Z
EPSS history
Timeline
  • 04 SEP 11:26Z
    User Activity Log < 1.6.6 - Subscriber+ Log Export
    cvelistv5