CVE-2026-8198: Logtivity WordPress Auth Bypass Vulnerability

CVE-2026-8198 Overview

CVE-2026-8198 affects the Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin for WordPress in versions up to and including 3.3.6. The vulnerability is an authentication bypass leading to information disclosure [CWE-200] in the verifyAuthorization method. Requests without an Authorization header skip Bearer token validation and reach an unconditional return true statement. Unauthenticated attackers can call the /wp-json/logtivity/v1/options REST API endpoint and retrieve all plugin configuration options, including the logtivity_site_api_key. The leaked API key allows attackers to impersonate the affected site when making API calls to the Logtivity service.

Critical Impact
Unauthenticated remote attackers can retrieve the logtivity_site_api_key and impersonate the WordPress site against the Logtivity service.

Affected Products

Logtivity plugin for WordPress, versions up to and including 3.3.6
Activity Logs, User Activity Tracking, Multisite Activity Log functionality exposed via REST API
WordPress sites exposing the /wp-json/logtivity/v1/options endpoint

Discovery Timeline

2026-05-09 - CVE-2026-8198 published to the National Vulnerability Database (NVD)
2026-05-11 - CVE-2026-8198 last modified in NVD database

Technical Details for CVE-2026-8198

Vulnerability Analysis

The flaw resides in the verifyAuthorization method of Logtivity_Rest_Endpoints.php, which is responsible for validating requests against the plugin's REST API routes. The method checks for the presence of an Authorization header and, when present, validates a Bearer token. When the header is absent, control flows past the validation logic and reaches a terminal return true statement. This treats unauthenticated callers as authorized.

The registered REST route /wp-json/logtivity/v1/options uses this method as its permission_callback. As a result, any unauthenticated HTTP request to the endpoint receives the full plugin configuration. The most sensitive value returned is logtivity_site_api_key, which authenticates the site to the upstream Logtivity logging service.

With the API key in hand, an attacker can submit forged log entries, suppress legitimate activity records, or otherwise impersonate the victim site to the Logtivity backend. This undermines the integrity of audit data that customers rely on for security monitoring.

Root Cause

The root cause is a logic flaw in verifyAuthorization. The function fails closed only when a malformed Authorization header is presented and fails open when no header is provided. Defaulting to return true violates secure-by-default authorization design.

Attack Vector

Exploitation requires a single unauthenticated HTTP GET request to the vulnerable REST endpoint over the network. No user interaction, privileges, or special conditions are required. The vulnerability mechanism is described in the WordPress Logtivity Endpoint Code and the corresponding Wordfence Vulnerability Report.

// No verified public exploit code is available.
// See the WordPress changeset and Wordfence report linked above for technical details.

Detection Methods for CVE-2026-8198

Indicators of Compromise

HTTP requests to /wp-json/logtivity/v1/options from unauthenticated or unexpected sources
HTTP 200 responses from the options endpoint containing the field logtivity_site_api_key
Unexpected log submissions or anomalous entries appearing in the Logtivity service tied to your site

Detection Strategies

Inspect web server access logs for GET requests to any /wp-json/logtivity/v1/ path lacking an Authorization header
Alert on REST API responses from the Logtivity options endpoint that exceed normal size or include the logtivity_site_api_key field
Correlate WordPress request logs with Logtivity backend activity to detect API key reuse from foreign IP addresses

Monitoring Recommendations

Enable verbose logging for WordPress REST API requests and forward to a central SIEM for retention
Track the installed Logtivity plugin version across all WordPress sites and flag any instance at 3.3.6 or earlier
Monitor outbound calls and inbound submissions against the Logtivity service for anomalies that suggest API key abuse

How to Mitigate CVE-2026-8198

Immediate Actions Required

Upgrade the Logtivity plugin to version 3.3.7 or later on every affected WordPress site
Rotate the logtivity_site_api_key after patching, since the prior value should be considered compromised
Review Logtivity service activity for evidence of forged or suppressed log entries during the exposure window

Patch Information

The vendor fixed the logic flaw in Logtivity 3.3.7. The corrected verifyAuthorization method now denies requests that lack a valid Bearer token instead of returning true. Refer to WordPress Changeset #3507386 and the patched code in Logtivity 3.3.7.

Workarounds

Restrict access to /wp-json/logtivity/v1/options at the web server or WAF layer until the patch is applied
Deactivate the Logtivity plugin temporarily on sites that cannot be updated immediately
Limit REST API exposure by enforcing authentication on all /wp-json/ endpoints via a hardening plugin or reverse proxy rule

bash

# Example nginx rule to block unauthenticated access to the vulnerable endpoint
location ~* ^/wp-json/logtivity/v1/options {
    deny all;
    return 403;
}