CVE-2023-4269
Assigner: WPScan
Published: 2023-09-04T11:26:56.095Z
State: PUBLISHED
title: User Activity Log < 1.6.6 - Subscriber+ Log Export
problemTypes: descriptions: description: CWE-863 Incorrect Authorization
type: CWE
affected: vendor: Unknown
product: User Activity Log
versions: status: affected
versionType: custom
version: 0
lessThan: 1.6.6
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
descriptions: value: The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated users, such as subscriber to perform such action and retrieve PII such as email addresses.
credits: value: Daniel Ruf
type: finder
value: WPScan
type: coordinator
source: discovery: EXTERNAL
x_generator: engine: WPScan CVE Generator