Junglewise Threat Intelligence

CVE-2026-7459: Simple History WordPress plugin account takeover via API information disclosure

CVE-2026-7459 · Severity: high · CVSS 7.5 · Published 2026-05-30

Executive brief

Simple History is a WordPress plugin used by site administrators to monitor and audit changes made to their website. A security flaw allows any logged-in user, even those with minimal permissions, to view sensitive audit logs that should be restricted. By accessing these logs, an attacker can intercept password reset links for administrators, allowing them to take full control of the website and its data.

Technical details

The vulnerability exists in the react_to_event() and unreact_to_event() functions within the Simple History plugin. These REST API endpoints use a weak permission callback (get_items_permissions_check()) that only verifies if a user is logged in, failing to enforce the granular capability checks required to view sensitive log data. An attacker with Subscriber-level access can use the '_fields=context' parameter to retrieve the full context of audit events. By triggering a password reset for an administrator and then querying the resulting log entry, the attacker can extract the secret reset key and gain full administrative access. This exploit requires the 'experimental features' setting to be enabled.

Affected products

  • Simple History Simple History – Track, Log, and Audit WordPress Changes Up to, and including, 5.26.0

Timeline

  • 2026-05-30: advisory: Vulnerability published to NVD

References

Related threats