CVE-2023-4269

Published Sep 4, 2023

Last updated a year ago

CVSS medium 4.3

Overview

Description: The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated users, such as subscriber to perform such action and retrieve PII such as email addresses.
Source: contact@wpscan.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.3
Impact score: 1.4
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-863

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:solwininfotech:user_activity_log:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "29A3F2DC-6FFA-488B-8B66-F30684240C97",
            "versionEndExcluding": "1.6.6"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References