Administrator SQL Injection allows an attacker who has administrative privileges to inject arbitrary SQL commands into the WP Activity Log plugin. This CWE‑89 flaw can lead to unauthorized reading, modification or deletion of data stored in the WordPress database, enabling data exfiltration, log tampering, or pivoting to further compromise the site.

The vulnerability affects installations of the WordPress WP Activity Log plugin version 5.6.6 or earlier from the Melapress vendor. No specific WordPress core or PHP version constraints are listed, so any WordPress site running a vulnerable plugin version is at risk.

The CVSS base score of 7.6 indicates high severity, but the EPSS score is not available and the flaw is not listed in the CISA KEV catalog, suggesting that public exploitation is currently limited. The attack requires administrator access, so the attack surface is confined to sites with exposed admin interfaces. Detection can be performed by monitoring for anomalous SQL queries or audit trail changes.