CVE-2023-3435
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitize and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks.
Risk Assessment
Attackers can exploit this vulnerability to gain access to sensitive data in the database, potentially leading to serious security breaches.
Recommendation
It is recommended to update the User Activity Log plugin to version 1.6.5 or later to mitigate this vulnerability.
Original NVD description (English source)
The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks.