The coreActivity plugin for WordPress stores the raw User‑Agent HTTP header in the logmeta table without sanitization. A malicious actor can send a specially crafted PHP serialized payload in the User‑Agent header during any event that the plugin logs. When an administrator later views the Logs page, the plugin unserializes the stored meta_value and passes it to DeviceDetector::setUserAgent(). The unserialized payload triggers a Fatal TypeError, causing the Logs page to fail permanently and preventing administrators from accessing it, effectively creating a persistent Denial of Service.

The vulnerability affects the coreActivity Activity Logging plugin for WordPress, all released versions up to and including 3.0. Users of these versions should verify their installed plugin version and be aware that the plugin is responsible for logging activity data.

The CVSS score for this issue is 8.1, indicating a high severity level. The EPSS score is not available, so the current exploit probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers do not need authentication; they only need to send a crafted User‑Agent header to any HTTP request that triggers the plugin’s logging. Since the malicious payload causes an error when an admin accesses the logs, the impact is localized to the administrative interface rather than the entire server.