CVE-2023-4150
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks.
Risk Assessment
The lack of proper CSRF protections may lead to unauthorized changes to the plugin's license by attackers, jeopardizing system integrity and potentially resulting in loss of control over the plugin.
Recommendation
It is recommended to update the plugin to version 4.0.9 or later to patch this vulnerability and to implement additional CSRF protections in license management.
Original NVD description (English source)
The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks