Vulnerabilities / Simple History – Track, Log, and Audit WordPress Changes / WPSEC-2026-1221
Simple History – Track, Log, and Audit WordPress Changes <= 5.35.0 - Authenticated (Editor+) Sensitive Information Exposure via REST API Stealth Mode Bypass
Low 2.2
CWE-863Fixed in 5.36.0
- ID
- WPSEC-2026-1221
- Plugin
- Simple History – Track, Log, and Audit WordPress Changes (simple-history)
- Affected
- from 5.6.0 before 5.36.0
- Remediation
- Update to 5.36.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-863
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-18
- Attack surface
- Simple History – Track, Log, and Audit WordPress Changes on WPSec AttackSurface
- Fix released
- Published
Description
The Simple History plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.35.0 due to Stealth Mode only hiding the admin interface while the REST API and Abilities API permission checks did not apply the Stealth Mode allowlist. This makes it possible for authenticated attackers with the capability to view the history (Editor-level access and above by default) who are excluded by Stealth Mode to read the full activity log through the simple-history/v1 REST routes such as /events. Exploitation requires Stealth Mode to be enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1221/
- https://plugins.svn.wordpress.org/simple-history/tags/5.36.0/
- https://wordpress.org/plugins/simple-history/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS