CVE-2026-8198
Authentication Bypass in Logtivity WordPress Plugin
Publication date: 2026-05-09
Last updated on: 2026-05-09
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| logtivity | logtivity | to 3.3.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Logtivity plugin for WordPress, specifically in versions up to and including 3.3.6. It is caused by a logic flaw in the verifyAuthorization method where requests that do not include an Authorization header bypass the Bearer token validation. Instead of properly checking authentication, the method returns true unconditionally, allowing unauthenticated attackers to access protected API endpoints.
As a result, attackers can access the /wp-json/logtivity/v1/options REST API endpoint without authentication and retrieve all plugin configuration options, including sensitive information like the logtivity_site_api_key.
How can this vulnerability impact me? :
This vulnerability can allow unauthenticated attackers to access sensitive configuration data of the Logtivity plugin, including the logtivity_site_api_key. With this key, attackers can impersonate the affected site in API calls to the Logtivity service, potentially leading to unauthorized actions or data exposure related to site activity logs.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to bypass authentication and access sensitive plugin configuration options, including an API key that can be used to impersonate the site in API calls.
This unauthorized access to sensitive information could potentially lead to data exposure or misuse, which may impact compliance with data protection regulations such as GDPR or HIPAA that require protection of sensitive data and proper access controls.
However, the provided information does not explicitly state the direct impact on compliance with these standards.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the /wp-json/logtivity/v1/options REST API endpoint is accessible without authentication. Since the flaw allows unauthenticated access, sending a request to this endpoint and observing if configuration options are returned indicates the presence of the vulnerability.
A simple command to test this would be using curl to send a GET request without any Authorization header:
- curl -X GET https://your-wordpress-site.com/wp-json/logtivity/v1/options
If the response contains plugin configuration details including sensitive keys like logtivity_site_api_key, the system is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Logtivity plugin to a version later than 3.3.6 where this authentication bypass flaw is fixed.
If an update is not immediately possible, restrict access to the /wp-json/logtivity/v1/options endpoint by implementing firewall rules or web server access controls to block unauthenticated requests.
Additionally, monitor your logs for any unauthorized access attempts to this endpoint and consider rotating any exposed API keys such as the logtivity_site_api_key.