Authentication Bypass in Logtivity Plugin for WordPress
CVE-2026-8198

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Activity Logs, User Activity Tracking, Multisite Activity Log From Logtivity
Vendor
CVE Published:
9 May 2026

What is CVE-2026-8198?

The Logtivity plugin for WordPress is susceptible to an authentication bypass vulnerability due to a logic flaw in the verifyAuthorization method. This flaw allows unauthenticated users to access sensitive information via the /wp-json/logtivity/v1/options REST API endpoint, including critical configuration details like the logtivity_site_api_key. Such access can enable attackers to impersonate the site in API calls to the Logtivity service, thereby posing significant security risks.

Affected Version(s)

Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity 0 <= 3.3.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/logtivity/tags...
https://plugins.trac.wordpress.org/browser/logtivity/tags...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ronnachai Chaipha
.