Exploitation observed; activity peaked at 3 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
The Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin for WordPress is vulnerable to Authentication Bypass to Information Disclosure in versions up to, and including, 3.3.6. This is due to a logic flaw in the verifyAuthorization method where requests without an Authorization header skip Bearer token validation and fall through to an unconditional return true statement, bypassing all authentication checks. This makes it possible for unauthenticated attackers to access the /wp-json/logtivity/v1/options REST API endpoint and retrieve all plugin configuration options, including the logtivity_site_api_key which can be used to impersonate the site in API calls to the Logtivity service.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-09 | 3 | Disclosure2General1 |
| 2026-05-10 | 1 | Active Exploitation1 |
A lot of offensive activities were identified targeting logtivity Activity Logs, User Activity Tracking, Multisite Activity Log Plugin (CVE-2026-8198) https://vuldb.com/vuln/362456/cti
Post summary
The statement reports ongoing offensive activity against the Multisite Activity Log Plugin (CVE-2026-8198), indicating that the vulnerability is being actively exploited, though no solutions or technical details are provided.
🔓 WordPress Logtivity plugin (≤ 3.3.6) vulnerable to auth bypass leading to information disclosure due to flawed authorization checks. #CVE #WordPress #Infosec https://nvd.nist.gov/vuln/detail/CVE-2026-8198
Post summary
A disclosure alert notes that WordPress Logtivity plugin (versions up to 3.3.6) suffers from an authentication bypass that can expose sensitive information, caused by improper authorization checks.
CVE-2026-8198 The Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin for WordPress is vulnerable to Authentication Bypass to Information Disclosure i… https://www.cve.org/CVERecord?id=CVE-2026-8198
Post summary
The excerpt merely states that CVE-2026-8198 affects the Logtivity WordPress plugin with an authentication bypass leading to information disclosure, with no further technical details, PoC, exploit, or patch information.
CVE-2026-8198 Authentication Bypass and Information Disclosure in Logtivity WordPress Plugin Versions Up to 3.3.6 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-8198
Post summary
The snippet announces a new CVE (Authentication Bypass and Information Disclosure) affecting Logtivity WordPress Plugin up to 3.3.6, providing basic technical details but no PoC, exploit code, or patch information.