CVE-2023-2285

The WP Activity Log Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajaxswitchdb function. This makes it possible for unauthenticated attackers to make changes to the...

CVE-2023-2284

CVE-2023-2284 (and related 2285) affects the WP Activity Log Premium plugin for WordPress. The issue is an unauthorized modification of data caused by a missing capability check in the ajax_switch_db function, affecting versions up to 4.5.0. Authenticated users with subscriber-level privileges or...

CVE-2023-2285

CVE-2023-2285 affects the WP Activity Log Premium WordPress plugin. The vulnerability is CSRF due to missing or incorrect nonce validation in the ajax_switch_db function, allowing unauthenticated attackers to forge requests to change plugin settings if a site admin is tricked into performing an a...