{
 "id": "WPSEC-2026-1222",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1222/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1222/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1222/index.md",
 "title": "Simple History – Track, Log, and Audit WordPress Changes <= 5.35.0 - Authenticated (Editor+) Missing Authorization to Restricted Event Disclosure via 'occasionsID' Parameter",
 "description": "The Simple History plugin for WordPress is vulnerable to Missing Authorization via the similar events (occasions) query in all versions up to, and including, 5.35.0. The query did not limit results to the loggers the current user is allowed to read, and occasion IDs are predictable. This makes it possible for authenticated attackers with the capability to view the history (Editor-level access and above by default) to read events from loggers they are not permitted to view, such as failed login events, by supplying a guessed 'occasionsID' value.",
 "plugin": {
  "slug": "simple-history",
  "name": "Simple History – Track, Log, and Audit WordPress Changes",
  "full_name": "Simple History – Track, Log, and Audit WordPress Changes",
  "wordpress_org": "https://wordpress.org/plugins/simple-history/",
  "advisories_url": "https://wpsec.com/vuln/plugin/simple-history/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/simple-history"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 2.7,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.36.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.36.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.36.0",
 "remediation": "Update to 5.36.0 or later.",
 "fix_released": "2026-10-17T11:18:34+00:00",
 "published": "2026-10-18T11:43:06+00:00",
 "updated": "2026-10-18T10:55:33.310017+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1222/",
  "https://plugins.svn.wordpress.org/simple-history/tags/5.36.0/",
  "https://wordpress.org/plugins/simple-history/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/simple-history",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-18"
 }
}