# Simple History – Track, Log, and Audit WordPress Changes <= 5.35.0 - Authenticated (Editor+) Missing Authorization to Restricted Event Disclosure via 'occasionsID' Parameter

- **ID:** WPSEC-2026-1222
- **Plugin:** Simple History – Track, Log, and Audit WordPress Changes (`simple-history`), https://wordpress.org/plugins/simple-history/
- **Affected versions:** all versions before 5.36.0
- **Fixed in:** 5.36.0 (Update to 5.36.0 or later.)
- **Severity:** Low 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-18)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/simple-history
- **Fix released:** 2026-10-17
- **Published:** 2026-10-18
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1222/

## Description

The Simple History plugin for WordPress is vulnerable to Missing Authorization via the similar events (occasions) query in all versions up to, and including, 5.35.0. The query did not limit results to the loggers the current user is allowed to read, and occasion IDs are predictable. This makes it possible for authenticated attackers with the capability to view the history (Editor-level access and above by default) to read events from loggers they are not permitted to view, such as failed login events, by supplying a guessed 'occasionsID' value.

## References

- https://wpsec.com/vuln/WPSEC-2026-1222/
- https://plugins.svn.wordpress.org/simple-history/tags/5.36.0/
- https://wordpress.org/plugins/simple-history/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1222/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.