# Simple History – Track, Log, and Audit WordPress Changes <= 5.35.0 - Unauthenticated Log Injection via Log Forwarding Local Files

- **ID:** WPSEC-2026-1220
- **Plugin:** Simple History – Track, Log, and Audit WordPress Changes (`simple-history`), https://wordpress.org/plugins/simple-history/
- **Affected versions:** from 5.21.0 before 5.36.0
- **Fixed in:** 5.36.0 (Update to 5.36.0 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-117
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-18)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/simple-history
- **Fix released:** 2026-10-17
- **Published:** 2026-10-18
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1220/

## Description

The Simple History plugin for WordPress is vulnerable to Log Injection via the Log Forwarding Local Files channel in all versions up to, and including, 5.35.0, due to insufficient neutralization of control characters, line breaks and Unicode line separators in the interpolated event message written to the log file by the human-readable formatter. This makes it possible for unauthenticated attackers to inject terminal escape sequences or line separators into the log file, for example through the username submitted in a failed login attempt, which can forge lines or change what an administrator sees when reading the file in a terminal. Exploitation requires the Local Files log forwarding channel to be enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-1220/
- https://plugins.svn.wordpress.org/simple-history/tags/5.36.0/
- https://wordpress.org/plugins/simple-history/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1220/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.