Vulnerability · Published Jun 1, 2026 · Assigned by Patchstack

CVE-2026-42673WordPress Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin <= 3.3.6 - Sensitive Data Exposure vulnerability

High 7.5

In plain English

A high-severity security flaw in Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity from Logtivity Activity Logs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.2%top 84.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Insertion of Sensitive Information Into Sent Data vulnerability in Logtivity Activity Logs Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity allows Retrieve Embedded Sensitive Data. This issue affects Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity: from n/a through 3.3.6.

Affected products (as reported)

Vendor	Product	Versions
Logtivity Activity Logs	Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity	n/a – through 3.3.6

Weakness: CWE-201 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://patchstack.com/database/wordpress/plugin/logtivity/vulnerability/wordpress-activity-logs-user-activity-tracking-multisite-activity-log-from-logtivity-plugin-3-3-6-sensitive-data-exposure-vulnerability?_s_id=cve vdb-entry