CVEvulnerability
CVE-2020-36716
7.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-06-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.3 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- CVSS 3.1 ([email protected])
- 7.3 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weaknesses
- CWE-862
Description
The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the setup_page function in versions up to, and including, 4.0.1. This makes it possible for unauthenticated attackers to run the setup wizard (if it has not been run previously) and access plugin configuration options.
Affected configurations
• wpwhitesecurity wp activity log (<= 4.0.1)
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://blog.nintechnet.com/vulnerabilities-fixed-in-wordpress-wp-security-audit-log-plugin/ Exploit
- https://plugins.trac.wordpress.org/changeset/2252006 Patch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9d0a8be3-6630-4cf7-b6cb-cdc86b99acb3?source=cve Third Party Advisory
- https://blog.nintechnet.com/vulnerabilities-fixed-in-wordpress-wp-security-audit-log-plugin/ Exploit
- https://plugins.trac.wordpress.org/changeset/2252006 Patch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9d0a8be3-6630-4cf7-b6cb-cdc86b99acb3?source=cve Third Party Advisory