CVE-2023-2284 — WP Activity Log Premium <= 4.5.0 - Missing Authorization via ajax_switch_db
The WP Activity Log Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_switch_db function in versions …
Published: 2023-06-09 · CVSS: 4.3 · CVSS 3.1
The WP Activity Log Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_switch_db function in versions up to, and including, 4.5.0. This makes it possible for authenticated attackers with subscriber-level or higher to make changes to the plugin's settings.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7