CVE-2026-8198

The Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin for WordPress is vulnerable to Authentication Bypass to Information Disclosure in versions up to, and including, 3.3.6. This is due to a logic flaw in the verifyAuthorization method where requests without an Authorization header skip Bearer token validation and fall through to an unconditional return true statement, bypassing all authentication checks. This makes it possible for unauthenticated attackers to access the /wp-json/logtivity/v1/options REST API endpoint and retrieve all plugin configuration options, including the logtivity_site_api_key which can be used to impersonate the site in API calls to the Logtivity service.

• CWE-200

• https://plugins.trac.wordpress.org/browser/logtivity/tags/3.3.6/Core/Services/Logtivity_Rest_Endpoints.php#L47
• https://plugins.trac.wordpress.org/browser/logtivity/tags/3.3.6/Core/Services/Logtivity_Rest_Endpoints.php#L78
• https://plugins.trac.wordpress.org/browser/logtivity/tags/3.3.7/Core/Services/Logtivity_Rest_Endpoints.php#L47
• https://plugins.trac.wordpress.org/browser/logtivity/tags/3.3.7/Core/Services/Logtivity_Rest_Endpoints.php#L78
• https://plugins.trac.wordpress.org/changeset/3507386/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/65ca20b0-0831-4f60-9021-679be6c145ef?source=cve

Published

May 9, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8192A security flaw has been discovered in Wavlink NU516U1 M16U1…8.8
• CVE-2026-8193A weakness has been identified in Akaunting 3.1.21. This iss…6.3
• CVE-2026-8194A security vulnerability has been detected in osTicket up to…4.3
• CVE-2026-8195A vulnerability was detected in JeecgBoot up to 3.9.1. The a…4.3
• CVE-2026-8196A flaw has been found in JeecgBoot 3.9.1. The impacted eleme…3.7
• CVE-2026-8197Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via…4.8
• CVE-2026-8199An authenticated user can cause excess memory usage via bitw…7.1
• CVE-2026-8200When schema validation is enabled on a collection and an upd…5.3
• CVE-2026-8201A use-after-free vulnerability exists in MongoDB's Field-Lev…8.8
• CVE-2026-8202Using a densely populated chars mask and a large input strin…6.5
• CVE-2026-8203Concrete CMS 9.5.0 and below has Stored XSS on the height pa…5.4
• CVE-2026-8204Concrete CMS 9.5.0 and below is vulnerable to authorization …5.3