WP Activity Log < 4.5.2 - Subscriber+ Information Leak

The plugin does not properly implement a capability check on the handle_ajax_call function, leading to an authorization bypass that allows authenticated users to obtain a list of users’ information, including ids, usernames, and emails.