CVE-2023-2261

CVE-2023-2261 describes an authorization bypass vulnerability in the WP Activity Log plugin for WordPress, affecting versions up to and including 4.5.0. This flaw allows authenticated users, even those with subscriber-level access, to enumerate site users, exposing their IDs, usernames, and email addresses. The vulnerability has a CVSS score of 4.3 (Medium), indicating a low attack complexity and requiring only low privileges, but with a limited impact on confidentiality. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.