SQL Injection Vulnerability in Activity Logging Plugin for WordPress

CVE-2025-3436

What is CVE-2025-3436?

The Activity Logging plugin for WordPress is susceptible to SQL Injection due to inadequate escaping of user-supplied parameters within the 'order' and 'orderby' fields. This flaw allows authenticated attackers with Subscriber-level access or higher to inject additional SQL queries into existing ones. By exploiting this vulnerability, attackers can gain unauthorized access to sensitive information stored in the database, which poses significant security risks for affected WordPress sites.

References