CVE-2026-42673: Logtivity Activity Logs Data Leak Flaw

CVE-2026-42673 Overview

CVE-2026-42673 is a sensitive information disclosure vulnerability in the Logtivity Activity Logs, User Activity Tracking, Multisite Activity Log WordPress plugin. The flaw is categorized under [CWE-201] Insertion of Sensitive Information Into Sent Data. It affects all plugin versions up to and including 3.3.6. An unauthenticated remote attacker can retrieve embedded sensitive data transmitted by the plugin without requiring user interaction or privileges.

Critical Impact
Unauthenticated network-based attackers can extract sensitive data embedded in plugin transmissions, exposing activity logs and tracking metadata from affected WordPress sites.

Affected Products

Logtivity Activity Logs, User Activity Tracking, Multisite Activity Log plugin for WordPress
All versions from initial release through 3.3.6
WordPress single-site and multisite installations using the plugin

Discovery Timeline

2026-06-01 - CVE-2026-42673 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-42673

Vulnerability Analysis

The vulnerability stems from the plugin embedding sensitive information into data it transmits, where that data is accessible to parties that should not receive it. The Logtivity plugin records WordPress activity events and forwards them through its logging pipeline. During this transmission, the plugin includes sensitive fields that an attacker can retrieve over the network.

The weakness is classified under [CWE-201] Insertion of Sensitive Information Into Sent Data. This category covers cases where a product places sensitive data in transmitted content without adequate access controls or sanitization. Exposure of activity logs can reveal user behavior, administrative actions, IP addresses, and other operational metadata that supports follow-on attacks.

Root Cause

The root cause is improper filtering of sensitive fields before they are inserted into outbound data structures generated by the plugin. The plugin code paths responsible for assembling activity log payloads do not enforce a sanitization or access-control boundary that prevents disclosure to unauthorized recipients.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker queries an exposed plugin endpoint or intercepts plugin-generated data to retrieve the embedded sensitive content. Successful exploitation impacts confidentiality only; integrity and availability are not affected.

No public proof-of-concept is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical specifics are documented in the Patchstack Logtivity Vulnerability Report.

Detection Methods for CVE-2026-42673

Indicators of Compromise

Unexpected outbound requests from WordPress hosts to Logtivity logging endpoints containing sensitive fields
Unauthenticated HTTP requests targeting plugin routes associated with activity log retrieval
Anomalous repeated access patterns to wp-content/plugins/logtivity/ resources from a single source

Detection Strategies

Inventory all WordPress installations and identify those running the Logtivity plugin at version 3.3.6 or earlier
Review web server access logs for unauthenticated requests to plugin endpoints returning verbose response payloads
Inspect outbound plugin transmissions for sensitive fields such as user identifiers, IP addresses, and administrative event metadata

Monitoring Recommendations

Alert on HTTP responses from WordPress sites that include activity log content delivered to unauthenticated clients
Monitor for scanner signatures targeting known WordPress plugin disclosure paths
Correlate WordPress plugin version inventory with vulnerability feeds to flag exposed instances in near real-time

How to Mitigate CVE-2026-42673

Immediate Actions Required

Identify all WordPress sites running the Logtivity plugin and confirm installed versions
Upgrade any instance at version 3.3.6 or earlier to a fixed release once published by the vendor
Restrict network access to WordPress administrative and plugin endpoints from untrusted sources

Patch Information

The vendor advisory for this issue is published through Patchstack. Administrators should consult the Patchstack Logtivity Vulnerability Report for the current patched version and apply the update through the WordPress plugin manager or by deploying the fixed package.

Workarounds

Deactivate the Logtivity plugin until a patched version can be installed if activity logging is not operationally required
Apply a web application firewall rule to block unauthenticated requests to Logtivity plugin endpoints
Limit egress from WordPress hosts so plugin-generated traffic only reaches trusted logging destinations

bash

# Example: disable the plugin via WP-CLI until patched
wp plugin deactivate logtivity --all
wp plugin status logtivity