CVE-2024-2018 is a high severity (CVSS 8.8) SQL injection flaw in the WP Activity Log Premium plugin for WordPress, versions up to and including 4.6.4. Authenticated users with subscriber rights can inject queries. Update to the latest version, since the record names no fixed release.
What's affected
The NVD record covers all versions of WP Activity Log Premium by Melapress up to and including 4.6.4. The vulnerable parameter is the entry roles parameter. The record's references are the Melapress changelog and a Wordfence entry. I read the changelog page, but the extract I found does not tie a specific fix to this CVE, and I could not retrieve the Wordfence page. The fixed version is therefore unconfirmed; the next release after 4.6.4 is the likely candidate, but check the changelog.
NVD scores it 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The description adds that one demonstrated attack included the injection of a PHP Object.
How to check if you're exposed
If you have WP-CLI, run wp plugin list and look for wp-security-audit-log-premium in the output, or wp plugin get wp-security-audit-log-premium and read the version row. Without it, open the Plugins screen in WordPress admin and read the version under the plugin name. Check every site you run, including staging copies and multisite networks. If that slug returns nothing, run wp plugin list and look for WP Activity Log in the name column. The Premium edition is a separate plugin from the free one.
The attacker needs only a subscriber account, so check whether your site allows open registration. If it does, anyone can create the required account.
What to do now
- Update WP Activity Log Premium to the current release and read the Melapress changelog for the first release above 4.6.4.
- If your site has open registration, review recent new accounts and remove those you do not recognize.
- Consider switching off open registration where it is not needed.
- Check your database and web logs for unusual queries or activity around the plugin's admin requests.
- Turn on automatic updates for security plugins, since they hold broad access.
Why it matters
The class is CWE-89, SQL injection. The entry roles value was not escaped enough and the existing SQL query was not prepared, so text supplied by a low privilege user could extend the query and read data from the database. The record says sensitive information could be extracted.
There is a sad irony in an audit and logging plugin being the weak point. It stores a record of site activity, and often user details, so a database read through it exposes both. Because it needs only subscriber rights, the practical barrier is low on any site with registration open. Using prepared statements with bound parameters in every query closes this class. The record's KEV flag is false, and no source I retrieved reports exploitation of this CVE in the wild. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your projects pull in the affected component. Safeguard reachability analysis can then help you separate code paths that actually call the weak component from those that only list it.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can a visitor with no account exploit it?
Not per the record. It needs at least a subscriber account, which may be easy to get if registration is open.
Which version fixes it?
Not confirmed in the sources I could read. Update to the latest and check the changelog.
Sources
Last reviewed: 19 October 2026.
