WP Activity Log <= 4.0.1 - Missing Authorization
Priority MEDIUM 40CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the setup_page function in versions up to, and including, 4.0.1. This makes it possible for unauthenticated attackers to run the setup wizard (if it has not been run previously) and access plugin configuration options.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00825 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed WP Activity Log (melapress): 4.0.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Melapress | WP Activity Log | before 4.0.2 | 4.0.2 | Patch available | CNA |
- WP Activity Log VendorMelapress Affected before 4.0.2 Fixed in 4.0.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wpwhitesecurity:wp_activity_log:*:*:*:*:*:wordpress:*:* | up to 4.0.1 | Vulnerable | wpwhitesecurity |
- cpe:2.3:a:wpwhitesecurity:wp_activity_log:*:*:*:*:*:wordpress:*:* Versions up to 4.0.1 Vulnerable ·wpwhitesecurity
Remediation
- Fix · CNA WP Activity Log (melapress) Fixed in 4.0.2
Timeline
- 2026-10-02 Threatist record created from CVE-2020-36716
- 2026-10-03 Alias added: GHSA-p8fg-fxjr-7v2x
References
More Melapress vulnerabilities
- TI-2023-27808 WordPress WP Activity Log Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1HIGH 7.1
- TI-2024-09166 Website File Changes < 2.1.1 - Authenticated SQL Injection CVSS 3.1MEDIUM 5.4
- TI-2024-09289 Website File Changes < 2.1.0 - Admin+ Authenticated SQL Injection CVSS 3.1MEDIUM 4.1
- TI-2026-39609 WordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Injection vulnerability CVSS 3.1CRITICAL 9.8
- TI-2025-06268 Authentication bypass in Melapress Login Security CVSS 3.1CRITICAL 9.8
- TI-2025-02511 Missing authorization in MelaPress Login Security Premium CVSS 3.1HIGH 8.2
Sources
- CVE-2020-36716 · CVE Program
- CVE-2020-36716 · NVD
- FIRST EPSS
- GHSA-p8fg-fxjr-7v2x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences