Description

Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-02T12:17:14.530Z",
  "pubdate": "2026-09-02T12:17:14.530Z",
  "executiveSummary": "The Activity Log plugin, in versions 2.13.1 and below, contains a critical security flaw involving Unauthenticated Cross-Site Request Forgery (CSRF).\nThis vulnerability allows an unauthenticated remote attacker to perform unauthorized actions by tricking an authenticated administrator into executing a malicious request.\nBecause the application fails to validate anti-CSRF tokens or implement sufficient session verification for sensitive operations within the Activity Log module, an attacker can manipulate the plugin's configuration or activity management settings.\nThe primary risk implication is the potential for unauthorized administrative state changes, such as clearing audit logs, modifying notification settings, or disabling tracking mechanisms that are essential for security monitoring.\nExploitation requires no authentication on the part of the attacker but depends on the successful social engineering of an authenticated user with sufficient privileges to trigger the forged request.\nIf successfully exploited, an attacker could effectively blind security monitoring efforts or tamper with the integrity of the activity logs, hindering forensic investigations.",
  "technicalDetails": "The vulnerability resides in the Activity Log plugin's failure to implement proper CSRF protection mechanisms for internal administrative actions. In versions 2.13.1 and earlier, the application processes state-changing requests—such as deleting logs, modifying plugin settings, or executing maintenance tasks—without verifying the presence or validity of a cryptographically secure anti-CSRF token (e.g., a nonce).\nThe root cause is the absence of request origin validation and the lack of unique token requirements for sensitive administrative endpoints. When an administrative user with an active session visits a malicious website controlled by an attacker, the browser may automatically append the user's session cookies to requests sent to the vulnerable Activity Log plugin. Because the plugin does not mandate a secondary form of authentication or token verification, it processes these requests as legitimate user-initiated actions.\nThe attack flow follows a classic CSRF pattern: 1) An attacker identifies the target URL endpoints used for administrative actions within the Activity Log plugin. 2) The attacker crafts a malicious payload, typically embedded within a hidden HTML form or an automated JavaScript fetch/XMLHttpRequest, designed to trigger the identified action on the plugin's backend. 3) The attacker lures a privileged administrator to a compromised or malicious web page. 4) Upon access, the malicious script executes the forged request in the context of the administrator's authenticated session. 5) The plugin backend validates the presence of the admin session, accepts the request, and executes the malicious instruction.\nThe vulnerable component is the underlying request handler responsible for processing administrative settings and log management operations. Because these functions are accessible via standard GET/POST request patterns without nonce verification, the surface area for unauthorized manipulation is significant. Post-exploitation, an attacker can achieve a range of impacts, primarily focusing on the suppression of audit data. By clearing logs or disabling the logging functionality, the attacker can effectively 'clear their tracks,' preventing security teams from detecting subsequent unauthorized activities. This manipulation of security-critical functionality represents a significant compromise of the overall security architecture, as the integrity of the audit trail is directly subverted to maintain stealth during persistent attacks."
}