CVE-2026-11907

Name of the Vulnerable Software and Affected Versions Stream plugin for WordPress versions prior to 4.2.1

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows authenticated attackers with subscriber-level access or higher to access all Stream activity records through the Heartbeat API, which is a communication protocol used by WordPress to send data between the browser and the server in real-time.

Recommendations Update the Stream plugin for WordPress to version 4.2.1 or later.