What’s Vulnerable › Vulnerabilities

CVE-2023-3435: User Activity Log < 1.6.5 - Unauthenticated SQLi

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-08-14 · updated 2026-06-17

Description

The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks.

Affected products

• User Activity Log: before 1.6.5 — fixed in 1.6.5

How to fix

Upgrade to a fixed version: User Activity Log 1.6.5. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/30a37a61-0d16-46f7-b9d8-721d983afc6b
• https://wpscan.com/vulnerability/30a37a61-0d16-46f7-b9d8-721d983afc6b

Get alerted when CVE-2023-3435 or the next vulnerability affects your stack