PT-2026-7839 · WordPress · Activity Log For Wordpress

Athiwat Tiprasaharn + 1 · Published 2026-02-12 · Updated 2026-02-12 · CVE-2026-1671

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Activity Log for WordPress versions up to and including 1.2.8

Description The Activity Log for WordPress plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check within the winter activity log action() function. Authenticated attackers with Subscriber-level access or higher can view sensitive information, such as administrator passwords, contained in exposed log files.

Recommendations Update Activity Log for WordPress to a version later than 1.2.8.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1671

Affected Products

Activity Log For Wordpress

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-1671 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5cec4c17-24c1-4ed3-a3d3-9404ad7af420?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3459369/winterlock · Note
• https://t.me/cveNotify/151820 · Telegram Post
• https://t.me/CVEtracker/44524 · Telegram Post