WordPress Plugin Vulnerabilities

Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity < 3.3.7 - Unauthenticated Information Exposure

Description

The Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.6. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

Affects Plugins

Plugin icon
logtivity
Fixed in 3.3.7

References

CVE
CVE-2026-42673
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/6a6bbcf9-5a49-4dfb-b863-2f3e61148864

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Peng Zhou
Verified
No
WPVDB ID
da7ba221-f654-4db1-9831-91892a4c35c2

Timeline

Publicly Published
2026-05-14 (about 3 months ago)
Added
2026-05-19 (about 3 months ago)
Last Updated
2026-05-19 (about 3 months ago)

Other

Published
Title
Published
2023-11-07
Title
Email Marketing for WooCommerce by Omnisend < 1.13.9 - Sensitive Information Exposure
Published
2025-12-31
Title
BoomDevs WordPress Coming Soon <= 1.0.4 - Unauthenticated Information Exposure
Published
2022-09-22
Title
Customer Reviews for WooCommerce < 5.3.6 - Unauthenticated Sensitive Information Disclosure
Published
2024-08-14
Title
ElementsKit Pro < 3.6.7 - Authenticated (Contributor+) Sensitive Information Exposure
Published
2025-02-04
Title
WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto < 8.0.9 - Unauthenticated Sensitive Information Exposure