Executive brief
The Logtivity plugin for WordPress, which tracks user activity and site logs, contains a security flaw that allows unauthorized individuals to access its configuration settings. By exploiting this, an attacker can steal the site's API key, which could allow them to impersonate the website when communicating with the Logtivity service. This could lead to the exposure of sensitive site configuration data and potential disruption of activity logging services.
Technical details
An authentication bypass exists in the Logtivity plugin for WordPress due to a logic flaw in the verifyAuthorization method within the REST API implementation. When a request is made without an Authorization header, the code skips Bearer token validation and incorrectly returns true, granting full access to the /wp-json/logtivity/v1/options endpoint. An unauthenticated attacker can exploit this over the network to retrieve the logtivity_site_api_key and other plugin settings. This key can subsequently be used to impersonate the affected site in API calls to the Logtivity service. The issue is fixed in version 3.3.7.
Affected products
- Logtivity Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity up to, and including, 3.3.6
Timeline
- 2026-05-09: disclosed
- 2026-05-09: advisory
References
- https://plugins.trac.wordpress.org/browser/logtivity/tags/3.3.6/Core/Services/Logtivity_Rest_Endpoints.php
- https://plugins.trac.wordpress.org/browser/logtivity/tags/3.3.6/Core/Services/Logtivity_Rest_Endpoints.php
- https://plugins.trac.wordpress.org/browser/logtivity/tags/3.3.7/Core/Services/Logtivity_Rest_Endpoints.php
- https://plugins.trac.wordpress.org/browser/logtivity/tags/3.3.7/Core/Services/Logtivity_Rest_Endpoints.php
- https://plugins.trac.wordpress.org/changeset/3507386/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/65ca20b0-0831-4f60-9021-679be6c145ef?source=cve