What is the CVSS score of CVE-2026-11907?

CVE-2026-11907 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

WordPress Stream Plugin CVE-2026-11907

EUVD-2026-54366 MEDIUM

Missing Authorization (CWE-862)

2026-08-07 Wordfence

GHSA-vq9h-6p44-rphw

WordPress Authentication Bypass Wordpress Plugin Stream Activity Log Audit Trail Xwp

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Subscriber authentication required (PR:L), network-accessible via default Heartbeat API (AV:N), read-only audit log disclosure with no integrity or availability impact (C:H, I:N, A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 05:22 vuln.today

CVE Published

Aug 07, 2026 - 04:25 nvd

MEDIUM 6.5

DescriptionCVE.org

The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to access all Stream activity records via the Heartbeat API.

AnalysisAI

Authorization bypass in the Stream - Activity Log & Audit Trail WordPress plugin (versions through 4.2.0) exposes the full site audit trail to any authenticated user holding a subscriber-level account or higher. The flaw resides in the plugin's Heartbeat API live-update handler, which returns activity records without verifying the requesting user holds the privileges required to view them (CWE-862). No public exploit or CISA KEV listing exists at time of analysis, but the low exploitation bar - any registered user account suffices - makes this a credible insider or low-effort attacker risk on sites with open registration.

Technical ContextAI

The Stream plugin (CPE: cpe:2.3:a:xwp:stream_-_activity_log_&_audit_trail:*:*:*:*:*:*:*:*) by XWP is a widely used WordPress activity logging and audit trail solution. WordPress's built-in Heartbeat API is an AJAX-based polling mechanism that plugins use to push real-time data from the server to the browser. The vulnerable code path is in class-live-update.php (visible at https://plugins.trac.wordpress.org/browser/stream/tags/4.2.1/classes/class-live-update.php#L186), where the plugin registers a Heartbeat API callback that returns Stream activity records in response to any authenticated Heartbeat request. The root cause is CWE-862 (Missing Authorization): the callback does not call current_user_can() or an equivalent capability check before serving log data, meaning the WordPress role/capability system is entirely bypassed for this API surface.

RemediationAI

Upgrade the Stream plugin to version 4.2.1 or later immediately; this version applies the missing authorization check in the Heartbeat API handler (class-live-update.php) and is available through the standard WordPress plugin repository update mechanism. For sites unable to patch immediately, disabling or deactivating the Stream plugin entirely will eliminate the attack surface at the cost of losing real-time activity log visibility. Alternatively, administrators can disable open user registration (Settings → General → uncheck 'Anyone can register') to deny external attackers the ability to obtain subscriber accounts, though this does not protect against compromised or malicious internal accounts. Restricting access to the WordPress admin-ajax.php endpoint via a web application firewall for unauthenticated or low-privilege sessions is an additional compensating control but carries the risk of breaking legitimate Heartbeat-dependent functionality. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b7c7e45a-581e-4cf0-83ac-cbca816701f1 provides further remediation context.