CVE-2026-54806

🗓️ 17 Jun 2026 09:51:45Reported by PatchstackType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 64 Views

Unauthenticated PHP object injection vulnerability in WordPress WP Activity Log plugin up to version 5.6.3.1.

Reporter	Title	Published	Views	Family All 7
GithubExploit	Exploit for CVE-2026-54806	22 Jun 202616:11	–	githubexploit
Circl	CVE-2026-54806	17 Jun 202613:50	–	circl
Cvelist	CVE-2026-54806 WordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Injection vulnerability	17 Jun 202609:51	–	cvelist
EUVD	EUVD-2026-37642	17 Jun 202618:35	–	euvd
NVD	CVE-2026-54806	17 Jun 202613:20	–	nvd
Patchstack	WordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Injection vulnerability	16 Jun 202614:20	–	patchstack
Positive Technologies	PT-2026-50359	17 Jun 202600:00	–	ptsecurity

Vulners

Node

melapress wp_activity_logRange≤5.6.3.1wordpress

[
  {
    "vendor": "Melapress",
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "wp-security-audit-log",
    "product": "WP Activity Log",
    "versions": [
      {
        "lessThanOrEqual": "5.6.3.1",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom",
        "changes": [
          {
            "at": "5.6.4",
            "status": "unaffected"
          }
        ]
      }
    ]
  }
]

Source	Link
patchstack	www.patchstack.com/database/wordpress/plugin/wp-security-audit-log/vulnerability/wordpress-wp-activity-log-plugin-5-6-3-1-php-object-injection-vulnerability

17 Jun 2026 17:17Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.19.8

EPSS0.00588

CWE-502