SQL Injection Vulnerability in WP Activity Log Premium Affects WordPress Sites

CVE-2024-2018

Summary

The WP Activity Log Premium plugin for WordPress is exposed to an SQL Injection vulnerability due to insufficient input validation and escaping mechanisms. This flaw affects all versions up to and including 4.6.4. An attacker with subscriber privileges can exploit this vulnerability by manipulating the entry->roles parameter, allowing them to inject additional SQL queries. Such an attack can lead to unauthorized access to sensitive information stored in the database. One notable example involves injecting a PHP Object, which may further compromise the integrity of the application and the data it handles.

References