What the vulnerability does
01Description
The Activity Log for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the winter_activity_log_action() function in all versions up to, and including, 1.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view potentially sensitive information (e.g., the password of a higher level user, such as an administrator) contained in the exposed log files.
Explanation of Vulnerability in Simple Terms
02Summary
The Activity Log for WordPress plugin through version 1.2.8 fails to properly check user permissions before allowing access to activity log data. A logged-in user with low privileges can read sensitive activity information they should not have access to. The plugin does not validate authorization on activity log endpoints, exposing confidential data to any authenticated user.
What an attacker can do
03Attacker Capabilities
Read activity logs and sensitive data they should not have access to.
Potential impact on your site
04Site Impact
Any logged-in user can view activity logs meant only for administrators, exposing site actions and user behavior.
Conditions required to exploit
05Prerequisites
Attacker must be logged in to WordPress with a low-privilege account (subscriber or contributor).
Key dates
06Disclosure timeline
February 12, 2026
CVE published
April 8, 2026
Record updated
