WP Activity Log: Unauthenticated PHP Object Injection (300,000+ Sites Affected)

Introduction

WP Activity Log, installed on more than 300,000 WordPress sites, had a high-severity unauthenticated PHP Object Injection vulnerability disclosed on June 16, 2026, rated CVSS 8.1. Versions before 5.6.4 are affected. Depending on what other code (plugins, theme, or WordPress core itself) is present on the site, this class of bug can be chained into remote code execution, arbitrary file deletion, or data exposure — even though the plugin itself doesn’t directly execute code.

What You Should Do Right Now

1. Check your version under Plugins in wp-admin. Anything before 5.6.4 needs attention.
2. Back up your site before updating, particularly given the plugin’s popularity means it’s a well-tested target for automated attacks.
3. Update to 5.6.4 or later as soon as possible.
4. Keep an eye on your activity log itself for anything unusual around the disclosure window — ironic, but this plugin’s own logs may show early signs if something was attempted.

Why “Just a PHP Object Injection” Still Matters

PHP Object Injection bugs are often underestimated because they don’t grant immediate access on their own — they need another vulnerable piece of code to “chain” into. But on a typical WordPress install running a dozen plugins, that second piece of code is more common than site owners assume. With 300,000+ sites running this plugin, it’s a large enough attack surface that researchers and attackers alike will be actively probing for exploitable chains.

FAQ

Do I need to do anything besides update?
For most sites, updating to 5.6.4 closes the vulnerability. If you suspect you were targeted before updating, a full malware scan is a reasonable precaution.

Why is a “logging” plugin a security risk?
Any plugin that processes serialized data from untrusted input can be vulnerable to object injection, regardless of what the plugin’s main feature is.

Is this being actively exploited?
No confirmed widespread exploitation has been reported as of this writing, but high-severity bugs on plugins with large install bases are routinely targeted soon after disclosure.

Conclusion

Popular plugins are popular targets. If you’re running WP Activity Log, update now and take a backup as part of the routine — not an afterthought.