{
 "id": "WPSEC-2026-1221",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1221/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1221/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1221/index.md",
 "title": "Simple History – Track, Log, and Audit WordPress Changes <= 5.35.0 - Authenticated (Editor+) Sensitive Information Exposure via REST API Stealth Mode Bypass",
 "description": "The Simple History plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.35.0 due to Stealth Mode only hiding the admin interface while the REST API and Abilities API permission checks did not apply the Stealth Mode allowlist. This makes it possible for authenticated attackers with the capability to view the history (Editor-level access and above by default) who are excluded by Stealth Mode to read the full activity log through the simple-history/v1 REST routes such as /events. Exploitation requires Stealth Mode to be enabled.",
 "plugin": {
  "slug": "simple-history",
  "name": "Simple History – Track, Log, and Audit WordPress Changes",
  "full_name": "Simple History – Track, Log, and Audit WordPress Changes",
  "wordpress_org": "https://wordpress.org/plugins/simple-history/",
  "advisories_url": "https://wpsec.com/vuln/plugin/simple-history/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/simple-history"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-863"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 2.2,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.6.0",
    "from_inclusive": true,
    "to": "5.36.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.6.0 before 5.36.0"
  ]
 },
 "introduced_in": "5.6.0",
 "fixed_in": "5.36.0",
 "remediation": "Update to 5.36.0 or later.",
 "fix_released": "2026-10-17T11:18:34+00:00",
 "published": "2026-10-18T11:43:06+00:00",
 "updated": "2026-10-18T10:55:33.310017+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1221/",
  "https://plugins.svn.wordpress.org/simple-history/tags/5.36.0/",
  "https://wordpress.org/plugins/simple-history/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/simple-history",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-18"
 }
}