PHP Object Injection Vulnerability in Activity Logging for WordPress Plugin

CVE-2026-7635

What is CVE-2026-7635?

The Activity Logging for WordPress plugin is vulnerable to PHP Object Injection due to inadequate validation of the User-Agent HTTP header. This flaw allows unauthorized attackers to craft PHP serialized payloads, which can be sent during logged events like failed logins. When the logs are accessed by an administrator, the injected data is deserialized, resulting in a Fatal TypeError that leads to a persistent Denial of Service condition, effectively blocking administrator access to critical logs. This vulnerability highlights the importance of robust input validation and secure data handling in plugins.

References