WordPress · Simple History · CVE-2026-7459
**Name of the Vulnerable Software and Affected Versions**
Simple History versions prior to 5.26.1
**Description**
The Simple History plugin for WordPress allows authenticated users with Subscriber-level permissions or higher to take over accounts. The issue exists in the event reaction endpoints "/wp-json/simple-history/v1/events/<id>/react" and "/wp-json/simple-history/v1/events/<id>/unreact", which use the `get items permissions check()` function as their permission callback. This function only verifies that the requester is logged in and fails to enforce the necessary per-logger capability checks. By sending a POST request to the reaction endpoint with the ` fields=context` query parameter, an attacker can read the full context of any event. This includes `SimpleUserLogger` entries that contain password-reset email bodies and reset keys. An attacker can trigger a password reset for an administrator, identify the event ID, extract the reset key from `context.message`, and reset the administrator password. This exploitation is only possible if the `simple history experimental features enabled` experimental features option is enabled.
**Recommendations**
Update the plugin to a version later than 5.26.0.
Disable the `simple history experimental features enabled` option to prevent exploitation.