Missing authorization checks in the WP System Log plugin for WordPress allow an attacker to read or otherwise manipulate log data that should be restricted to privileged users. This forms a classic Broken Access Control weakness, as defined by CWE-862, and can expose sensitive operational information or enable further compromise if logs contain exploitable data.

The vulnerability affects the WP System Log plugin developed by activity‑log.com. All versions from the earliest release up to and including 1.2.7 are impacted. Users running this plugin on any WordPress site are potentially exposed.

The CVSS score is not supplied, and EPSS information is unavailable, so the quantitative risk is unclear. However, because the flaw resides in a web‑based plugin, exploitation would occur remotely via HTTP requests to the plugin’s endpoints. It is inferred that the attack vector requires web access to the site, and the lack of an authentication requirement for the vulnerable actions suggests that the threat can be exercised by unauthenticated users or those with low privileges.