CVE-2026-54806
CriticalCVSS 9.8Summary
The WP Activity Log plugin versions up to 5.6.3.1 are vulnerable to unauthenticated PHP object injection.
Risk Assessment
An attacker could exploit this vulnerability to execute unauthorized code, potentially leading to system compromise.
Recommendation
It is recommended to update the WP Activity Log plugin to the latest version to mitigate this vulnerability.
Other vulnerabilities in WP Activity Log
See all- CVE-2026-62085High
The WP Activity Log plugin versions 5.6.6 and earlier contain an SQL Injection vulnerability exploitable by an administrator. An administrator can exploit this to execute unauthorized queries against the database.
- CVE-2026-56005High
Stored XSS vulnerability in the WP Activity Log plugin by Melapress. Improper input neutralization during web page generation allows persistent script injection. Affects versions from n/a through 5.6.3.1.
- CVE-2026-45435Medium
The WP Activity Log plugin up to version 5.6.3 is vulnerable to DOM-based XSS due to improper input neutralization during page generation.
Original NVD description (English source)
Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS