The coreActivity: Activity Logging for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0. This is due to the plugin failing to validate or strip PHP serialization syntax from the User-Agent HTTP header before storing it in the logmeta table, and subsequently calling `maybe_unserialize()` on every retrieved `meta_value` in `query_metas()` without verifying the data was originally serialized by the application. This makes it possible for unauthenticated attackers to inject a crafted PHP serialized payload via the User-Agent header during any logged event (such as a failed login attempt), which, when an administrator views the Logs page, is deserialized and passed to `DeviceDetector::setUserAgent()`, triggering a Fatal TypeError that creates a persistent Denial of Service condition blocking administrator access to the Logs page entirely.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
gdragon coreActivity: Activity Logging for WordPress unaffected
Version Status Constraints
0 affected ≤ 3.0

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/dev4press/coreactivity/pull/3/changes/1f09331d66de7cf4bba9b6e396b0d4e7597fcde2 cve-icon
https://plugins.trac.wordpress.org/browser/coreactivity/tags/3.0/core/log/Core.php#L252 cve-icon
https://plugins.trac.wordpress.org/browser/coreactivity/tags/3.0/core/log/Device.php#L35 cve-icon
https://plugins.trac.wordpress.org/browser/coreactivity/tags/3.0/core/table/Logs.php#L161 cve-icon
https://plugins.trac.wordpress.org/browser/coreactivity/tags/3.0/vendor/dev4press/library/dev4press/core/plugins/DBLite.php#L268 cve-icon
https://plugins.trac.wordpress.org/browser/coreactivity/tags/3.0/vendor/dev4press/library/dev4press/wordpress/admin/Table.php#L290 cve-icon
https://plugins.trac.wordpress.org/browser/coreactivity/trunk/core/log/Core.php#L252 cve-icon
https://plugins.trac.wordpress.org/browser/coreactivity/trunk/core/log/Device.php#L35 cve-icon
https://plugins.trac.wordpress.org/browser/coreactivity/trunk/core/table/Logs.php#L161 cve-icon
https://plugins.trac.wordpress.org/browser/coreactivity/trunk/vendor/dev4press/library/dev4press/core/plugins/DBLite.php#L268 cve-icon
https://plugins.trac.wordpress.org/browser/coreactivity/trunk/vendor/dev4press/library/dev4press/wordpress/admin/Table.php#L290 cve-icon
https://www.wordfence.com/threat-intel/vulnerabilities/id/59f30135-6dd9-4367-90a9-a10ad491357d?source=cve cve-icon
History

Wed, 13 May 2026 04:45:00 +0000

Type Values Removed Values Added
Description The coreActivity: Activity Logging for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0. This is due to the plugin failing to validate or strip PHP serialization syntax from the User-Agent HTTP header before storing it in the logmeta table, and subsequently calling `maybe_unserialize()` on every retrieved `meta_value` in `query_metas()` without verifying the data was originally serialized by the application. This makes it possible for unauthenticated attackers to inject a crafted PHP serialized payload via the User-Agent header during any logged event (such as a failed login attempt), which, when an administrator views the Logs page, is deserialized and passed to `DeviceDetector::setUserAgent()`, triggering a Fatal TypeError that creates a persistent Denial of Service condition blocking administrator access to the Logs page entirely.
Title coreActivity: Activity Logging for WordPress <= 3.0 - Unauthenticated PHP Object Injection via 'user_agent' Log Meta Field
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-05-13T04:26:39.499Z

Reserved: 2026-05-01T15:23:35.095Z

Link: CVE-2026-7635

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses