CVE-2026-8198 Details
Description
The Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin for WordPress is vulnerable to Authentication Bypass to Information Disclosure in versions up to, and including, 3.3.6. This is due to a logic flaw in the verifyAuthorization method where requests without an Authorization header skip Bearer token validation and fall through to an unconditional return true statement, bypassing all authentication checks. This makes it possible for unauthenticated attackers to access the /wp-json/logtivity/v1/options REST API endpoint and retrieve all plugin configuration options, including the logtivity_site_api_key which can be used to impersonate the site in API calls to the Logtivity service.
A vulnerability exists in the Logtivity WordPress plugin, specifically in the Activity Logs, User Activity Tracking, and Multisite Activity Log features, in versions through 3.3.6. The issue is an authentication bypass that leads to unauthorized information disclosure. This vulnerability arises from a logic flaw in the 'verifyAuthorization' method, where requests lacking an Authorization header bypass Bearer token validation and authentication checks entirely. As a result, unauthenticated attackers can access the '/wp-json/logtivity/v1/options' REST API endpoint and retrieve sensitive plugin configuration options, including the 'logtivity_site_api_key', which can be used to impersonate the site in API calls to the Logtivity service.
Users are advised to update the Logtivity WordPress plugin to version 3.3.7 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 9, 2026CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Logtivity | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 9, 2026 | New CVE Received | [email protected] |