What is the CVSS score of CVE-2026-42673?

CVE-2026-42673 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Logtivity Activity Logs are affected by CVE-2026-42673?

The Logtivity Activity Logs WordPress plugin (versions 3.3.6 and earlier) contains a critical data exposure vulnerability allowing unauthorized remote access to sensitive logged information without…

How to fix or mitigate CVE-2026-42673?

Within 24 hours: Deactivate the Logtivity plugin in WordPress administration or implement WAF/firewall rules restricting plugin endpoint access to authorized administrative IP ranges only. Within 7 days: Conduct forensic review of plugin-generated activity logs for unauthorized access attempts; document what categories of sensitive information may have been exposed. Within 30 days: Monitor Logtivity vendor advisory channels for release of patched version 3.3.7 or later; if patch timeline remains unclear beyond 30 days, implement permanent replacement with alternative activity logging solution that has undergone security audit.

Logtivity Activity Logs CVE-2026-42673

EUVD-2026-33690 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-06-01 Patchstack

GHSA-873w-p97p-f26x

Information Disclosure Activity Logs User Activity Tracking Multisite Activity Log From Logtivity

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 17:18 vuln.today

DescriptionCVE.org

Insertion of Sensitive Information Into Sent Data vulnerability in Logtivity Activity Logs Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity allows Retrieve Embedded Sensitive Data.

This issue affects Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity: from n/a through 3.3.6.

AnalysisAI

Sensitive data exposure in the Logtivity Activity Logs, User Activity Tracking, Multisite Activity Log WordPress plugin (versions up to and including 3.3.6) allows remote unauthenticated attackers to retrieve embedded sensitive information from data sent by the plugin. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable exploitation with no privileges or user interaction, though no public exploit identified at time of analysis and the issue is not on the CISA KEV list.

Technical ContextAI

The affected component is a WordPress plugin published by Logtivity that records site activity, user actions, and multisite events. The root cause maps to CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin embeds sensitive values into outbound data - typically log payloads, API responses, or telemetry transmissions - where they become observable to unintended parties. The CPE string cpe:2.3:a:logtivity_activity_logs:... confirms the affected product is the Logtivity plugin family covering activity logs, user activity tracking, and multisite activity logging. Because the plugin's purpose is to capture and transmit event data, the data-sending path is central to its function, making this class of weakness particularly relevant.

RemediationAI

No vendor-released patch identified at time of analysis from the provided data - the Patchstack advisory documents the issue through version 3.3.6 but no fixed version is enumerated in the input, so administrators should consult the Patchstack entry at https://patchstack.com/database/wordpress/plugin/logtivity/vulnerability/wordpress-activity-logs-user-activity-tracking-multisite-activity-log-from-logtivity-plugin-3-3-6-sensitive-data-exposure-vulnerability and the Logtivity vendor site for an updated release beyond 3.3.6 and upgrade as soon as one is available. As compensating controls, deactivate the plugin if activity logging is non-essential (trade-off: loss of audit trail and multisite event visibility), restrict outbound network egress from the WordPress host to only the Logtivity SaaS endpoint to prevent leakage to untrusted destinations (trade-off: may break legitimate integrations if egress rules are too narrow), and place any plugin-exposed REST or AJAX endpoints behind authentication via a WAF rule or .htaccess restriction (trade-off: may prevent legitimate unauthenticated callers if any exist). Rotate any secrets, API tokens, or session identifiers that may have been written into log payloads transmitted by the plugin.