CVE-2026-8198 Auth bypass in Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity
Unauthenticated attackers can bypass authentication to access REST API endpoints and retrieve sensitive plugin configuration data, including API keys.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-8198?
CVE-2026-8198 is a medium-severity authentication bypass vulnerability in Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity, published on 9 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin for WordPress is vulnerable to Authentication Bypass to Information Disclosure in versions up to, and including, 3.3.6. This is due to a logic flaw in the verifyAuthorization method where requests without an Authorization header skip Bearer token validation and fall through to an unconditional return true statement, bypassing all authentication checks. This makes it possible for unauthenticated attackers to access the /wp-json/logtivity/v1/options REST API endpoint and retrieve all plugin configuration options, including the logtivity_site_api_key which can be used to impersonate the site in API calls to the Logtivity service.
Weakness: CWE-200
Which versions are affected by CVE-2026-8198?
How do I fix CVE-2026-8198?
No fix has been published for CVE-2026-8198 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-8198 being exploited?
There is no known exploitation of CVE-2026-8198 in the wild and no public exploit code.
Sources
Also known as GHSA-5rh7-8226-g7fr.