CVE-2023-4269 User Activity Log < 1.6.6 - Subscriber+ Log Export

The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated users, such as subscriber to perform such action and retrieve PII such as email addresses...

CVE-2023-4269

Summary (CVE-2023-4269) The WordPress plugin “User Activity Log” (pre-1.6.6) incorrectly authorizes log exports, allowing any authenticated user (e.g., a subscriber) to export activity logs and access PII such as email addresses. This is documented in multiple sources (Red Hat advisory RH:CVE-202...