PT-2025-21372 · WordPress · Logdash Activity Log

Nicolas Surribas · Published 2025-05-15 · Updated 2026-03-11 · CVE-2023-6030

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: LogDash Activity Log WordPress plugin versions prior to 1.1.4

Description: The issue concerns a SQL injection vulnerability. It occurs because the plugin does not properly escape the username when performing SQL requests, specifically when logging failed login attempts through the wp login failed function. This can be exploited by an unauthenticated attacker using time-based techniques.

Recommendations: For versions prior to 1.1.4, update to version 1.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the wp login failed function until a patch is applied. Avoid using the username variable in affected SQL requests until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-6030

Affected Products

Logdash Activity Log

References · 6

• 🔥 https://wpscan.com/vulnerability/b658e403-006c-4555-b1b2-3603e44f4411 · Exploit
• https://osv.dev/vulnerability/CVE-2023-6030 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6030 · Security Note
• https://twitter.com/pdnuclei_bot/status/2031701706736849012 · Twitter Post
• https://twitter.com/CVEnew/status/1923119264418115890 · Twitter Post
• https://t.me/cvenotify/125429 · Telegram Post