CVE-2026-84759: Activity Log CSRF Vulnerability

CVE-2026-84759 Overview

CVE-2026-84759 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability affecting the Activity Log WordPress plugin in versions up to and including 2.13.1. The flaw is tracked under CWE-352 and allows attackers to induce authenticated users to submit unwanted requests to a vulnerable site. Exploitation requires user interaction, such as convincing a logged-in administrator to visit a malicious page. Successful exploitation can compromise the confidentiality, integrity, and availability of plugin-managed data on the affected WordPress installation.

Critical Impact
An attacker can hijack authenticated administrator sessions to perform state-changing actions on the Activity Log plugin without the victim's consent.

Affected Products

Aryo Activity Log plugin for WordPress, versions <= 2.13.1
WordPress installations with the vulnerable plugin enabled
Sites exposing plugin endpoints to authenticated administrator sessions

Discovery Timeline

2026-09-02 - CVE-2026-84759 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84759

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery (CSRF) issue [CWE-352] in the Aryo Activity Log WordPress plugin. The plugin fails to validate anti-CSRF tokens (nonces) on one or more state-changing request handlers. An unauthenticated attacker can craft a malicious page that, when visited by an authenticated user, triggers a forged request to the target WordPress site. Because the request is executed in the context of the victim's session, the server processes it with the victim's privileges.

According to the Patchstack WordPress Vulnerability Analysis, the flaw affects the plugin's request handling logic. The scope is marked as changed, meaning exploitation can affect resources beyond the vulnerable component.

Root Cause

The root cause is missing or improper CSRF token verification on privileged endpoints. WordPress provides wp_verify_nonce() and check_admin_referer() primitives that plugins must invoke on state-changing actions. When these checks are absent, browsers automatically attach session cookies to cross-origin requests, allowing forged requests to be authenticated by the server.

Attack Vector

Exploitation requires an attacker to lure an authenticated user, typically an administrator, to a malicious web page. The page issues a crafted HTTP request (via a form auto-submit, image tag, or fetch call) to the vulnerable Activity Log endpoint. Because the victim's browser attaches valid session cookies, the plugin processes the request as legitimate.

The vulnerability manifests as missing nonce validation on plugin request handlers. See the linked Patchstack advisory for endpoint-specific technical details.

Detection Methods for CVE-2026-84759

Indicators of Compromise

Unexpected changes to Activity Log plugin settings or log entries not attributable to legitimate administrator activity.
HTTP POST or GET requests to plugin endpoints with a cross-origin Referer or Origin header.
Administrator account actions occurring shortly after the user visited an untrusted external site.

Detection Strategies

Inspect web server access logs for requests to Activity Log plugin endpoints that lack a valid WordPress nonce parameter.
Correlate administrator authentication events with subsequent plugin state changes to identify unauthorized modifications.
Deploy a Web Application Firewall (WAF) rule that flags cross-origin POST requests to /wp-admin/ paths without matching Referer headers.

Monitoring Recommendations

Enable WordPress audit logging for plugin configuration changes and administrator sessions.
Alert on outbound browser traffic from administrator workstations to newly registered or low-reputation domains.
Track plugin version inventory across all WordPress sites to identify installations running <= 2.13.1.

How to Mitigate CVE-2026-84759

Immediate Actions Required

Update the Aryo Activity Log plugin to a version later than 2.13.1 as soon as the vendor publishes a patched release.
Restrict administrator access to trusted networks and require re-authentication for sensitive actions.
Instruct administrators to log out of WordPress sessions before browsing untrusted sites.

Patch Information

Refer to the Patchstack WordPress Vulnerability Analysis for the current patch status and fixed version details. Apply plugin updates through the WordPress admin dashboard or by replacing the plugin directory from a verified source.

Workarounds

Disable or uninstall the Activity Log plugin until a fixed version is available.
Deploy WAF rules that enforce SameSite=Strict cookie policies and block cross-origin state-changing requests to WordPress admin paths.
Use browser isolation or a dedicated administrator browser profile that does not visit untrusted sites during active WordPress sessions.

bash

# Example WAF rule concept: block cross-origin POST requests to WordPress admin endpoints
# without a matching Referer header on the same origin.
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:1,deny,status:403,id:1008471,msg:'Potential CSRF against WordPress admin'"
SecRule REQUEST_URI "@beginsWith /wp-admin/" "chain"
SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-wordpress-site.example/"