Vulnerabilities / Simple History – Track, Log, and Audit WordPress Changes / WPSEC-2026-1222
Simple History – Track, Log, and Audit WordPress Changes <= 5.35.0 - Authenticated (Editor+) Missing Authorization to Restricted Event Disclosure via 'occasionsID' Parameter
Low 2.7
CWE-639Fixed in 5.36.0
- ID
- WPSEC-2026-1222
- Plugin
- Simple History – Track, Log, and Audit WordPress Changes (simple-history)
- Affected
- all versions before 5.36.0
- Remediation
- Update to 5.36.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-18
- Attack surface
- Simple History – Track, Log, and Audit WordPress Changes on WPSec AttackSurface
- Fix released
- Published
Description
The Simple History plugin for WordPress is vulnerable to Missing Authorization via the similar events (occasions) query in all versions up to, and including, 5.35.0. The query did not limit results to the loggers the current user is allowed to read, and occasion IDs are predictable. This makes it possible for authenticated attackers with the capability to view the history (Editor-level access and above by default) to read events from loggers they are not permitted to view, such as failed login events, by supplying a guessed 'occasionsID' value.
References
- https://wpsec.com/vuln/WPSEC-2026-1222/
- https://plugins.svn.wordpress.org/simple-history/tags/5.36.0/
- https://wordpress.org/plugins/simple-history/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS