CVE-2026-42673: WordPress Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin <= 3.3.6 - Sensitive Data Exposure vulnerability

Synopsis

This is a sensitive data exposure vulnerability in the Logtivity Activity Logs, User Activity Tracking, and Multisite Activity Log WordPress plugin (versions up to and including 3.3.6). The plugin inserts sensitive information into data it transmits over the network, and the flaw is reachable remotely without any authentication. Successful exploitation allows an attacker to retrieve embedded sensitive data from the transmitted payload, resulting in confidentiality loss. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via standard HTTP/HTTPS to trigger the data leak.

• AuthenticationNot required

  No account or session credentials are needed; the flaw is exploitable by any unauthenticated party who can send a request to the affected service.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; exploitation is fully automated and requires no social-engineering step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is straightforward and condition-free with no race conditions or special environmental factors required.

Blast Radius

• An attacker retrieves sensitive information embedded in data the plugin transmits, which may include API keys, session tokens, user credentials, or other application secrets depending on what the plugin logs and sends.
• Exposed credentials or tokens can be replayed to authenticate to connected services or administrative interfaces, extending the attacker's reach beyond the WordPress host.
• Logged user-activity data containing personally identifiable information (PII) or behavioral records may be disclosed, creating regulatory and compliance exposure for the affected organization.