CVE-2025-0767

WP Activity Log 5.3.2 - Insecure deserialization

CVSS 6.3 MEDIUMEPSS 0.4%CWE-502

WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/classes/Writers/class-csv-writer.php.

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Affected products

Melapress · WP Activity Log

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://co.wordpress.org/plugins/wp-security-audit-log/https://fluidattacks.com/advisories/skims-9/