Medium severity4.3NVD Advisory· Published Jun 9, 2023· Updated Apr 8, 2026

CVE-2023-2286

Description

The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajax_run_cleanup function. This makes it possible for unauthenticated attackers to invoke this function via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected products

Wpwhitesecurity/Wp Activity Log2 versions
cpe:2.3:a:wpwhitesecurity:wp_activity_log:*:*:*:*:premium:wordpress:*:*+ 1 more
- cpe:2.3:a:wpwhitesecurity:wp_activity_log:*:*:*:*:premium:wordpress:*:*range: <=4.5.0
- cpe:2.3:a:wpwhitesecurity:wp_activity_log:*:*:*:*:*:wordpress:*:*range: <=4.5.0

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

plugins.trac.wordpress.org/browser/wp-security-audit-log/trunk/classes/Views/Settings.phpnvdPatch
plugins.trac.wordpress.org/changesetnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/e2008e0b-32c6-46fb-93b9-2b0004f478e8nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000