CVE-2023-6030 — LogDash Activity Log < 1.1.4 - Unauthenticated SQLi
The LogDash Activity Log WordPress plugin before 1.1.4 hooks the wp_login_failed function (from src/Hooks/Users.php) in order to log failed login attempts to the database but it…
Published: 2025-05-15 · CVSS: 5.4 · CVSS 3.1
The LogDash Activity Log WordPress plugin before 1.1.4 hooks the wp_login_failed function (from src/Hooks/Users.php) in order to log failed login attempts to the database but it doesn't escape the username when it perform some SQL request leading to a SQL injection vulnerability which can be exploited using time-based technique by unauthenticated attacker
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7