Is CVE-2026-65512 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65512 being exploited in the wild.

How severe is CVE-2026-65512?

Medium severity, with a CVSS score of 5.4, published 23 July 2026.

Which products and versions are affected?

Melapress WP Activity Log <= 5.6.4.

Is there a fix for CVE-2026-65512?

A patch was published on 2026-07-23: Version 5.6.5 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65512 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-65512?

Check whether you run Melapress WP Activity Log at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65512: Melapress WP Activity Log CSRF in plugin settings

Q: Is there a fix for CVE-2026-65512?

A patch was published on 2026-07-23: Version 5.6.5 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-65512 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-65512?

Check whether you run Melapress WP Activity Log at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65512 · Severity: medium · CVSS 5.4 · Published 2026-07-23

WP Activity Log is a popular WordPress plugin used to track and log user activity on a website for security and auditing purposes. A security vulnerability exists where an attacker can trick a site administrator into performing unintended actions, such as changing plugin settings or deleting logs, by getting them to click a malicious link. While this requires the administrator to be logged in and interact with a specific link, it could lead to unauthorized changes to the site's audit trail.

Technologies: Melapress WP Activity Log. Vendors: Melapress.

Quick answers

Is CVE-2026-65512 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65512 being exploited in the wild.
How severe is CVE-2026-65512?: Medium severity, with a CVSS score of 5.4, published 23 July 2026.
Which products and versions are affected?: Melapress WP Activity Log <= 5.6.4.
Is there a fix for CVE-2026-65512?: A patch was published on 2026-07-23: Version 5.6.5 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65512 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-65512?: Check whether you run Melapress WP Activity Log at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the WP Activity Log plugin for WordPress due to insufficient nonce validation on sensitive actions. An unauthenticated remote attacker can exploit this by crafting a malicious request and tricking a logged-in administrator into executing it (e.g., via phishing or a malicious site). Successful exploitation allows the attacker to perform actions with the privileges of the victim, such as modifying plugin configurations or audit logs. The issue is fixed in version 5.6.5.

Affected products

Melapress WP Activity Log <= 5.6.4

Timeline

2026-07-02: disclosed: Reported by Levon Balyan
2026-07-23: advisory: Published by Patchstack and NVD
2026-07-23: patched: Version 5.6.5 released to address the issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.