PT-2025-21372 · WordPress · Logdash Activity Log

Nicolas Surribas · Publicado 2025-05-15 · Atualizado 2026-03-11 · CVE-2023-6030

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: LogDash Activity Log WordPress plugin versions prior to 1.1.4

Description: The issue concerns a SQL injection vulnerability. It occurs because the plugin does not properly escape the username when performing SQL requests, specifically when logging failed login attempts through the wp login failed function. This can be exploited by an unauthenticated attacker using time-based techniques.

Recommendations: For versions prior to 1.1.4, update to version 1.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the wp login failed function until a patch is applied. Avoid using the username variable in affected SQL requests until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-6030

Produtos afetados

Logdash Activity Log

Referências · 6

• 🔥 https://wpscan.com/vulnerability/b658e403-006c-4555-b1b2-3603e44f4411 · Exploit
• https://osv.dev/vulnerability/CVE-2023-6030 · Aviso do Fabricante
• https://twitter.com/pdnuclei_bot/status/2031701706736849012 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1923119264418115890 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-6030 · Nota de Segurança
• https://t.me/cvenotify/125429 · Publicação no Telegram