PT-2026-45088 · WordPress · Simple History
CVSS v3.1
7.5
High
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Simple History versions prior to 5.26.1
Description
The Simple History plugin for WordPress allows authenticated users with Subscriber-level permissions or higher to take over accounts. The issue exists in the event reaction endpoints "/wp-json/simple-history/v1/events//react" and "/wp-json/simple-history/v1/events//unreact", which use the
get items permissions check() function as their permission callback. This function only verifies that the requester is logged in and fails to enforce the necessary per-logger capability checks. By sending a POST request to the reaction endpoint with the fields=context query parameter, an attacker can read the full context of any event. This includes SimpleUserLogger entries that contain password-reset email bodies and reset keys. An attacker can trigger a password reset for an administrator, identify the event ID, extract the reset key from context.message, and reset the administrator password. This exploitation is only possible if the simple history experimental features enabled experimental features option is enabled.Recommendations
Update the plugin to a version later than 5.26.0.
Disable the
simple history experimental features enabled option to prevent exploitation.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Simple History