SQL Injection Vulnerability in WP Activity Log Premium Affects WordPress Sites

CVE-2024-2018

What is CVE-2024-2018?

The WP Activity Log Premium plugin for WordPress is exposed to an SQL Injection vulnerability due to insufficient input validation and escaping mechanisms. This flaw affects all versions up to and including 4.6.4. An attacker with subscriber privileges can exploit this vulnerability by manipulating the entry->roles parameter, allowing them to inject additional SQL queries. Such an attack can lead to unauthorized access to sensitive information stored in the database. One notable example involves injecting a PHP Object, which may further compromise the integrity of the application and the data it handles.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References