What the vulnerability does
01Description
The Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin for WordPress is vulnerable to Authentication Bypass to Information Disclosure in versions up to, and including, 3.3.6. This is due to a logic flaw in the verifyAuthorization method where requests without an Authorization header skip Bearer token validation and fall through to an unconditional return true statement, bypassing all authentication checks. This makes it possible for unauthenticated attackers to access the /wp-json/logtivity/v1/options REST API endpoint and retrieve all plugin configuration options, including the logtivity_site_api_key which can be used to impersonate the site in API calls to the Logtivity service.
Explanation of Vulnerability in Simple Terms
02Summary
Logtivity Activity Logs versions 3.3.6 and earlier expose sensitive information that can be accessed over the network without authentication. An attacker can read data that should be restricted, such as activity logs or user tracking information. The vulnerability requires no special privileges or user interaction to exploit.
What an attacker can do
03Attacker Capabilities
Read sensitive activity logs and user tracking data without logging in.
Potential impact on your site
04Site Impact
Attackers can view activity logs and user tracking records that may contain private user behavior or site administration details.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 9, 2026
CVE published
May 11, 2026
Record updated
