SQL Injection Vulnerability in Activity Logging Plugin for WordPress

CVE-2025-3436

What is CVE-2025-3436?

The Activity Logging plugin for WordPress is susceptible to SQL Injection due to inadequate escaping of user-supplied parameters within the 'order' and 'orderby' fields. This flaw allows authenticated attackers with Subscriber-level access or higher to inject additional SQL queries into existing ones. By exploiting this vulnerability, attackers can gain unauthorized access to sensitive information stored in the database, which poses significant security risks for affected WordPress sites.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References