CVE-2025-0767: Critical Deserialization Flaw in WP Activity Log

CVE-2025-0767 is a critical flaw (CVSS 9.8) in the WP Activity Log WordPress plugin, version 5.3.2, where user input reaches PHP unserialize. Update the plugin beyond 5.3.2 and read the vendor changelog to confirm the exact fixed release.

What's affected

• Product: WP Activity Log (WP Security Audit Log) by Melapress, a WordPress plugin.
• Version named in the record: 5.3.2.
• Weakness: CWE-502, deserialization of untrusted data.
• Location: the CSV writer class, file class-csv-writer.php.
• Fixed version: the record does not state one. Check the plugin's changelog on WordPress.org.
• CISA KEV: not listed.

The only technical source is a finding by Fluid Attacks, produced by its Skims code analysis tool. The finding shows an AJAX handler that checks a nonce, then base64 decodes a query request field and passes it to unserialize. The CVSS vector is network, no privileges and no user interaction. That rating is the record's. Be aware that the sample code checks a nonce, so how easy it is to reach in a given site is worth testing with the vendor's guidance rather than assuming.

How to check if you're exposed

1. In the WordPress admin, open Plugins and look for WP Activity Log. Note the version.
2. From the command line with WP-CLI, run the plugin list command and look for wp-security-audit-log in the output:

wp plugin list

3. On multi site installs, check each site and the network admin.
4. Compare the version with the vendor's changelog. If it is 5.3.2 or you cannot find a later fix noted, update.
5. Review your web server logs for POST requests to admin-ajax.php that you cannot explain, particularly around the export feature.

What to do now

1. Back up the site and database.
2. Update WP Activity Log to the latest release with wp plugin update wp-security-audit-log or through the dashboard.
3. After updating, confirm the version is higher than 5.3.2.
4. If you cannot update now, deactivate the plugin until you can. An audit log plugin is useful, but not worth an open critical bug.
5. Review admin accounts and recently installed plugins or files for anything unexpected.
6. Keep PHP and WordPress core current, since deserialization risk grows when other classes are present to be abused.

Why it matters

Deserialization turns stored bytes back into live objects. PHP's unserialize can create objects of any class loaded in the application, and some classes run code when they are created or destroyed. If an outsider controls the input, they may be able to chain those behaviors into something harmful. That is why CWE-502 bugs often score as critical.

The safer pattern is to avoid unserializing request data at all. Use a data only format such as JSON and validate it, or sign the data so tampering is detected.

A plugin that records everything on a site is a juicy target, because it sits on admin pages and often runs with wide rights. It is also a plugin that site owners trust and forget. Add it to a short list of components you review every month.

Quick check

Sources

• Fluid Attacks advisory for CVE-2025-0767
• WP Activity Log on WordPress.org
• NVD record for CVE-2025-0767

Last reviewed: 19 October 2026.