CVE-2026-24987
Missing Authorization in WP System Log ≤1.2.7 Enables Unauthorized Access
Publication date: 2026-03-25
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| activity-log | wp_system_log | to 1.2.7 (inc) |
| patchstack | wp_system_log_plugin | to 1.2.7 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-24987 is a medium severity Broken Access Control vulnerability in the WordPress WP System Log Plugin versions up to and including 1.2.7.
The issue arises from missing authorization, authentication, or nonce token checks in certain plugin functions, which allows unprivileged users such as subscribers or developers to perform actions that normally require higher privileges.
This flaw is classified under the OWASP Top 10 category A1: Broken Access Control and was discovered by researcher NumeX.
It is considered moderately dangerous and likely to be exploited in mass campaigns targeting many websites regardless of their popularity.
How can this vulnerability impact me? :
This vulnerability can allow unauthorized users to escalate their privileges within affected WordPress sites.
Exploitation could lead to unauthorized actions being performed, potentially compromising the integrity and security of the website.
Because it affects access control, attackers might manipulate logs or perform other sensitive operations without proper permissions.
The risk is moderate with a CVSS score of 6.5, indicating a significant security concern that should be addressed promptly.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability arises from missing authorization checks in the WP System Log Plugin versions up to 1.2.7, allowing unprivileged users to perform unauthorized actions. Detection involves checking the plugin version and monitoring for unauthorized privilege escalation attempts.
To detect if your system is vulnerable, first verify the installed version of the WP System Log Plugin. If it is version 1.2.7 or earlier, your system is at risk.
- Use WP-CLI to check the plugin version: `wp plugin get wp-system-log --field=version`
- Review web server logs for suspicious requests that might exploit missing authorization, such as unusual POST requests to plugin endpoints.
- Monitor user activity logs for unexpected privilege escalations or actions performed by low-privileged users.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to update the WP System Log Plugin to version 1.2.8 or later, where this vulnerability is patched.
Until the update can be applied, you can use Patchstack’s mitigation rules to block attacks targeting this vulnerability.
Additionally, enabling auto-updates for vulnerable plugins via Patchstack can help ensure timely protection against this and similar vulnerabilities.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The CVE-2026-24987 vulnerability is a broken access control issue that allows unauthorized users to perform actions requiring higher privileges within affected WordPress sites. Such unauthorized privilege escalation can lead to unauthorized access to sensitive data or system functions.
While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, broken access control vulnerabilities generally pose risks to data confidentiality and integrity, which are critical components of these regulations. Exploitation of this vulnerability could potentially result in unauthorized data access or modification, thereby impacting compliance with data protection and privacy regulations.
Therefore, organizations using affected versions of the WP System Log Plugin should promptly apply the patch (version 1.2.8 or later) or mitigations to reduce the risk of non-compliance due to unauthorized access incidents.