CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in activity-log.com WP System Log winterlock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP System Log: from n/a through <= 1.2.7.
Explanation of Vulnerability in Simple Terms
WP System Log versions 1.2.7 and earlier lack proper authorization checks, allowing authenticated users with low privileges to read sensitive system logs they should not access. An attacker with a basic WordPress account can view confidential logging data without additional interaction. Update to a version newer than 1.2.7 to restrict log access to authorized administrators only.
What an attacker can do
Read system logs and sensitive information they lack permission to view.
Potential impact on your site
Confidential logs containing user data, errors, or system details may be exposed to any logged-in user.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
