CVE-2026-1671

Name of the Vulnerable Software and Affected Versions Activity Log for WordPress versions up to and including 1.2.8

Description The Activity Log for WordPress plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check within the winter activity log action() function. Authenticated attackers with Subscriber-level access or higher can view sensitive information, such as administrator passwords, contained in exposed log files.

Recommendations Update Activity Log for WordPress to a version later than 1.2.8.