What is the CVSS score of CVE-2026-8198?

CVE-2026-8198 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Logtivity WordPress Plugin CVE-2026-8198

EUVD-2026-28914 MEDIUM

Information Exposure (CWE-200)

2026-05-09 Wordfence

GHSA-5rh7-8226-g7fr

Authentication Bypass Information Disclosure WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 09, 2026 - 13:15 vuln.today

CVE Published

May 09, 2026 - 12:29 nvd

MEDIUM 5.3

DescriptionCVE.org

The Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin for WordPress is vulnerable to Authentication Bypass to Information Disclosure in versions up to, and including, 3.3.6. This is due to a logic flaw in the verifyAuthorization method where requests without an Authorization header skip Bearer token validation and fall through to an unconditional return true statement, bypassing all authentication checks. This makes it possible for unauthenticated attackers to access the /wp-json/logtivity/v1/options REST API endpoint and retrieve all plugin configuration options, including the logtivity_site_api_key which can be used to impersonate the site in API calls to the Logtivity service.

AnalysisAI

Unauthenticated attackers can bypass REST API authentication in the Logtivity plugin (versions up to 3.3.6) via a logic flaw in the verifyAuthorization method, allowing direct access to the /wp-json/logtivity/v1/options endpoint and disclosure of sensitive configuration including the logtivity_site_api_key. This key can be leveraged to impersonate the affected WordPress site in API calls to the Logtivity service. CVSS 5.3 (low confidentiality impact) reflects information disclosure severity; no active exploitation in CISA KEV at time of analysis.

Technical ContextAI

The Logtivity plugin exposes REST API endpoints through WordPress's /wp-json/ infrastructure. The verifyAuthorization method in Logtivity_Rest_Endpoints.php implements Bearer token validation for API requests but contains a critical logic flaw: requests lacking an Authorization header entirely bypass token checking and unconditionally return true, falling through to an allow-all default case. This violates CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) by exposing REST endpoints that should require authentication. The affected endpoint /wp-json/logtivity/v1/options returns plugin configuration including the logtivity_site_api_key, a credential used for Logtivity service authentication. The vulnerability exists because the method fails to reject requests absent valid authorization before returning success.

RemediationAI

Upgrade immediately to version 3.3.7 or later, which restores proper authentication validation in the verifyAuthorization method. Update via WordPress admin dashboard (Plugins > Installed Plugins > Logtivity > Update) or manually download from plugins.wordpress.org. If immediate patching is delayed, disable the Logtivity plugin entirely via wp-plugin deactivate logtivity (command-line) or manually from wp-admin/plugins.php, removing REST endpoint exposure until patch deployment; note that this also disables activity logging functionality. As an interim compensating control, use a Web Application Firewall (WAF) to block all requests to /wp-json/logtivity/* endpoints for untrusted source IPs, or implement .htaccess-based IP whitelisting to the /wp-json/ directory if Logtivity API calls originate only from known administrative networks. If the logtivity_site_api_key has been exposed, immediately rotate the credential via the Logtivity service dashboard and audit past API activity for unauthorized access.