CVE-2020-36716
📋 TL;DR
The WP Activity Log plugin for WordPress has an authorization bypass vulnerability that allows unauthenticated attackers to run the plugin's setup wizard and access configuration options. This affects all WordPress sites using WP Activity Log version 4.0.1 or earlier where the setup wizard hasn't been completed.
💻 Affected Systems
- WP Activity Log (formerly WP Security Audit Log)
📦 What is this software?
Wp Activity Log by Wpwhitesecurity
⚠️ Risk & Real-World Impact
Worst Case
Attackers could reconfigure the plugin to disable security logging, modify audit settings, or potentially chain with other vulnerabilities to gain administrative access.
Likely Case
Attackers could disable security auditing functionality, preventing detection of other malicious activities on the WordPress site.
If Mitigated
If the setup wizard was already completed before exploitation attempts, the vulnerability has no impact.
🎯 Exploit Status
Exploitation requires sending a simple HTTP request to the vulnerable endpoint. No authentication or special conditions needed beyond the setup wizard not being completed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.2
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/2252006
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find WP Activity Log
4. Click 'Update Now' if available
5. If no update available, download version 4.0.2+ from WordPress.org
6. Upload and replace the plugin files
🔧 Temporary Workarounds
Complete Setup Wizard
allManually run the setup wizard to make the vulnerable endpoint inaccessible
Navigate to /wp-admin/admin.php?page=wsal-setup in your WordPress admin
Block Vulnerable Endpoint
linuxUse web application firewall or .htaccess to block access to the setup endpoint
# Add to .htaccess:
RewriteEngine On
RewriteRule ^wp-content/plugins/wp-security-audit-log/classes/Views/Setup.*$ - [F,L]
🧯 If You Can't Patch
- Complete the plugin setup wizard immediately to remove the vulnerable state
- Temporarily disable the WP Activity Log plugin until patching is possible
🔍 How to Verify
Check if Vulnerable:
Check if /wp-content/plugins/wp-security-audit-log/classes/Views/Setup.php exists and if the plugin version is 4.0.1 or lower in WordPress admin → PluginsCheck Version:
grep -r "Version:" /path/to/wordpress/wp-content/plugins/wp-security-audit-log/wp-security-audit-log.php | head -1Verify Fix Applied:
Verify plugin version is 4.0.2 or higher in WordPress admin → Plugins, and attempt to access /wp-admin/admin.php?page=wsal-setup without authentication (should be blocked)📡 Detection & Monitoring
Log Indicators:
- Unauthenticated POST requests to /wp-admin/admin-ajax.php with action=wsal_setup
- Access to /wp-admin/admin.php?page=wsal-setup from unauthenticated users
- Sudden changes to WP Activity Log configuration without admin activity
Network Indicators:
- HTTP requests to setup-related endpoints from external IPs without authentication cookies
SIEM Query:
source="web_access_logs" AND (uri_path="/wp-admin/admin.php" AND query_string="page=wsal-setup" AND NOT user_agent="WordPress/*")🔗 References
- https://blog.nintechnet.com/vulnerabilities-fixed-in-wordpress-wp-security-audit-log-plugin/
- https://plugins.trac.wordpress.org/changeset/2252006
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9d0a8be3-6630-4cf7-b6cb-cdc86b99acb3?source=cve
- https://blog.nintechnet.com/vulnerabilities-fixed-in-wordpress-wp-security-audit-log-plugin/
- https://plugins.trac.wordpress.org/changeset/2252006
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9d0a8be3-6630-4cf7-b6cb-cdc86b99acb3?source=cve
