Simple History – Track, Log, and Audit WordPress Changes <= 5.35.0 - Unauthenticated Log Injection via Log Forwarding Local Files
- ID
- WPSEC-2026-1220
- Plugin
- Simple History – Track, Log, and Audit WordPress Changes (simple-history)
- Affected
- from 5.21.0 before 5.36.0
- Remediation
- Update to 5.36.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-117
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-18
- Attack surface
- Simple History – Track, Log, and Audit WordPress Changes on WPSec AttackSurface
- Fix released
- Published
Description
The Simple History plugin for WordPress is vulnerable to Log Injection via the Log Forwarding Local Files channel in all versions up to, and including, 5.35.0, due to insufficient neutralization of control characters, line breaks and Unicode line separators in the interpolated event message written to the log file by the human-readable formatter. This makes it possible for unauthenticated attackers to inject terminal escape sequences or line separators into the log file, for example through the username submitted in a failed login attempt, which can forge lines or change what an administrator sees when reading the file in a terminal. Exploitation requires the Local Files log forwarding channel to be enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1220/
- https://plugins.svn.wordpress.org/simple-history/tags/5.36.0/
- https://wordpress.org/plugins/simple-history/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS