High severity · published Apr 9, 2024
CVE-2024-2018
WP Activity Log Premium <= 4.6.4 - Authenticated (Subscriber+) SQL Injection
8.8
CVSS
0.9%
EPSS
No
On KEV
Description
The WP Activity Log Premium plugin for WordPress is vulnerable to SQL Injection via the entry->roles parameter in all versions up to, and including, 4.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. One demonstrated attack included the injection of a PHP Object.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
WP Activity Log Premium · wpwhitesecurity
through 4.6.4 · source: vendor
WA
WP Activity Log · Melapress
before 4.6.4.1 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-2018
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-2018
Product
https://melapress.com/support/kb/wp-activity-log-plugin-changelog/
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/2f060ea1-01e2-4e5b-82ba-b5cdd0d8290a?source=cve
More from WP Activity Log Premium
4.3
CVE-2023-2261
WP Activity Log <= 4.5.0 - Missing Capabilities Check to User Enumeration
4.3
CVE-2023-2286
WP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanup
4.3
CVE-2023-2284
WP Activity Log Premium <= 4.5.0 - Missing Authorization via ajax_switch_db
4.3
CVE-2023-2285
WP Activity Log Premium <= 4.5.0 - Cross-Site Request Forgery via ajax_switch_db