WP Activity Log < 5.6.4 - Unauthenticated PHP Object Injection

Description

The plugin does not validate or sanitise some input before deserialising it, which could allow unauthenticated users to inject a PHP Object. No known POP chain is present in the vulnerable software, however one present in another plugin or theme installed on the same site could allow attackers to delete arbitrary files, retrieve sensitive data, or execute code.