CVE-2020-36716: falha de alta gravidade em melapress WP Activity Log
WP Activity Log <= 4.0.1 - Missing Authorization
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.3epss 0.8%
The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the setup_page function in versions up to, and including, 4.0.1. This makes it possible for unauthenticated attackers to run the setup wizard (if it has not been run previously) and access plugin configuration options.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
melapress · WP Activity LogCVEs relacionadas — melapress WP Activity Log
No mesmo produto, das mais perigosas para as menos.
CVE-2024-10793HIGHWP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id ParameterEPSS 1.5%CVE-2025-0924HIGHWP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.4%CVE-2023-2261MEDIUMWP Activity Log <= 4.5.0 - Missing Capabilities Check to User EnumerationEPSS 0.6%CVE-2022-4974MEDIUMFreemius SDK <= 2.4.2 - Missing Authorization ChecksEPSS 0.4%CVE-2023-2286MEDIUMWP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanupEPSS 0.3%CVE-2026-120075HIGHWP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.2%