# Simple History – Track, Log, and Audit WordPress Changes <= 5.35.0 - Authenticated (Editor+) Sensitive Information Exposure via REST API Stealth Mode Bypass

- **ID:** WPSEC-2026-1221
- **Plugin:** Simple History – Track, Log, and Audit WordPress Changes (`simple-history`), https://wordpress.org/plugins/simple-history/
- **Affected versions:** from 5.6.0 before 5.36.0
- **Fixed in:** 5.36.0 (Update to 5.36.0 or later.)
- **Severity:** Low 2.2 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-18)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/simple-history
- **Fix released:** 2026-10-17
- **Published:** 2026-10-18
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1221/

## Description

The Simple History plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.35.0 due to Stealth Mode only hiding the admin interface while the REST API and Abilities API permission checks did not apply the Stealth Mode allowlist. This makes it possible for authenticated attackers with the capability to view the history (Editor-level access and above by default) who are excluded by Stealth Mode to read the full activity log through the simple-history/v1 REST routes such as /events. Exploitation requires Stealth Mode to be enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-1221/
- https://plugins.svn.wordpress.org/simple-history/tags/5.36.0/
- https://wordpress.org/plugins/simple-history/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1221/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.