CVE-2023-2261: 
WordPress vulnerability analysis and mitigation

CVE-2023-2261 affects the WP Activity Log plugin for WordPress versions below 4.5.2. The vulnerability was discovered and publicly disclosed on May 17, 2023, with the fix being released in version 4.5.2. This security issue impacts WordPress installations using the affected plugin versions (WPScan).

The vulnerability stems from a missing capability check in the handleajaxcall function, which leads to an authorization bypass vulnerability. The issue is classified as a Sensitive Data Disclosure vulnerability, falling under the OWASP Top 10 category A3: Sensitive Data Exposure and CWE-200. The vulnerability has been assigned a CVSS score of 4.3 (medium) (WPScan).

When exploited, this vulnerability allows authenticated users (including those with subscriber-level access) to obtain sensitive information about other users on the system. The exposed information includes user IDs, usernames, and email addresses (WPScan).

The vulnerability has been patched in WP Activity Log version 4.5.2. Site administrators should update to this version or later to protect against this security issue. No alternative workarounds have been publicly documented (WPScan).