This vulnerability (CVE-2026-65512) is a CWE-352 Cross-Site Request Forgery (CSRF) issue in Melapress WP Activity Log and WP Activity Log Premium plugins for WordPress. Versions up to 5.6.4 are affected. The flaw allows attackers to trick authenticated users into submitting unwanted requests, potentially leading to unauthorized actions. The CVSS vector indicates the attack can be performed remotely without privileges but requires user interaction. The vulnerability impacts integrity and availability but not confidentiality. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to cause the affected plugin to perform actions without the user's consent, potentially leading to integrity and availability impacts on the WordPress site. Confidentiality is not impacted. The attack requires user interaction and can be performed remotely without authentication privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider implementing CSRF protections such as verifying nonces or tokens in requests if possible, and limit exposure by restricting access to the plugin's administrative functions. Monitor official Melapress communications for updates.