CVE-2026-7459

Vulnerability

The Simple History – Track, Log, and Audit WordPress Changes plugin for WordPress up to version 5.26.0 includes reaction endpoints (react_to_event() / unreact_to_event()) that use get_items_permissions_check() as their permission callback. This callback only verifies that the requester is logged in and does not enforce per-logger capability checks normally applied by Log_Query. As a result, any authenticated user (Subscriber+) can POST to /wp-json/simple-history/v1/events//react with the _fields=context query parameter and retrieve the full context of any Simple History event. Exploitation requires an administrator to have enabled the experimental features option (simple_history_experimental_features_enabled), which is not the default [1].

Exploitation

An attacker with Subscriber-level access triggers a password reset for an administrator via the standard WordPress lost-password form. They then brute-force recent event IDs by repeatedly POSTing to /wp-json/simple-history/v1/events//react with _fields=context until they locate the user_requested_password_reset_link event. The reset key is extracted from the context.message field of that event, and the attacker uses it to complete the password reset, thereby taking over the administrator account [1].

Impact

Successful exploitation results in full account takeover of an administrator account. The attacker gains administrative privileges over the WordPress site, enabling complete control over the installation, including content, users, and settings [1].

Mitigation

The vulnerability is fixed in Simple History version 5.26.1. Users should update to this version or later immediately. As a workaround, administrators can disable the experimental features option (simple_history_experimental_features_enabled) if it is enabled, which prevents the vulnerable endpoint from being registered. No other workaround is available [1].