WP Activity Log, CVE-2023-2284

CVE, Research URL: CVE-2023-2284
Home page URL: Security reports for WP Activity Log
Application: WP Activity Log
Published on: Jun 09, 2023
Research Description: The WP Activity Log Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_switch_db function in versions up to, and including, 4.5.0. This makes it possible for authenticated attackers with subscriber-level or higher to make changes to the plugin's settings.
Affected versions: Min -, max 4.5.2.
Status: vulnerable