Junglewise Threat Intelligence

CVE-2026-7635: dev4press coreActivity PHP Object Injection in User-Agent header

CVE-2026-7635 · Severity: high · CVSS 8.1 · Published 2026-05-13

Executive brief

The coreActivity plugin for WordPress, which tracks and logs site activity, contains a security flaw that allows unauthenticated attackers to disrupt site management. By sending a specially crafted web request, an attacker can inject malicious data into the activity logs. When a site administrator later attempts to view these logs, the malicious data triggers a critical error that completely blocks access to the logging interface, potentially hiding other malicious activity or causing a persistent denial of service for administrative functions.

Technical details

The coreActivity plugin for WordPress is vulnerable to PHP Object Injection in versions up to and including 3.0. The vulnerability exists because the plugin fails to sanitize or validate the User-Agent HTTP header before storing it in the 'logmeta' database table. When an administrator views the Logs page, the plugin calls `maybe_unserialize()` on the retrieved data in `query_metas()`. An unauthenticated attacker can provide a crafted PHP serialized payload in the User-Agent header during a logged event (like a failed login). When deserialized, this payload is passed to `DeviceDetector::setUserAgent()`, triggering a Fatal TypeError. This results in a persistent Denial of Service that prevents administrators from accessing the Logs page. A fix appears to be available in the plugin's repository (likely version 3.1).

Affected products

  • dev4press coreActivity: Activity Logging for WordPress Up to and including 3.0

Timeline

  • 2026-05-05: patched: Fix committed to GitHub repository
  • 2026-05-13: advisory: NVD and Wordfence published advisory

References