CVE-2026-7459: Simple History WordPress Plugin Account Takeover Vulnerability

Technical summary

CVE-2026-7459 is an authenticated privilege escalation and account takeover vulnerability in Simple History up to version 5.26.0. The react_to_event() and unreact_to_event() REST endpoints register get_items_permissions_check() as their permission callback. This callback only confirms the user is logged in via is_user_logged_in(), bypassing the per-logger capability checks that Log_Query normally enforces. A Subscriber-level user can POST to /wp-json/simple-history/v1/events/{id}/react with _fields=context to retrieve full event context. SimpleUserLogger records password-reset email bodies, including the reset token, in event context. An attacker can brute-force recent event IDs, extract the reset key from user_requested_password_reset_link events, and complete a password reset on any administrator account. Exploitation requires simple_history_experimental_features_enabled to be true, which is not the default setting.

Business impact

A successful exploit grants an attacker full administrator access to the WordPress site, enabling site-wide defacement, malware injection, data theft, and business continuity disruption. Because password-reset links contain time-sensitive tokens, the attack window is limited but predictable for an attacker who can monitor or trigger the reset. For multi-administrator environments, the loss of a single admin account is still critical. Organizations using this plugin in production may face regulatory and reputational damage if a compromise occurs. The requirement for experimental features to be enabled reduces—but does not eliminate—the real-world impact, as some power users and developers enable experimental options for testing.

Affected systems

Any WordPress installation running the Simple History – Track, Log, and Audit WordPress Changes plugin at version 5.26.0 or earlier is affected if the simple_history_experimental_features_enabled option has been enabled. The vulnerability requires REST API access and an authenticated attacker account with Subscriber or higher privileges. Sites that have not enabled experimental features are not impacted. No distinction exists among WordPress hosting environments (shared, managed, VPS, dedicated); all are equally vulnerable if both conditions are met.

Exploitability

Exploitation is moderate in difficulty but high in impact. An attacker must first obtain a Subscriber-level account (registration must be enabled, or the attacker must have insider access). The attacker then needs to trigger an administrator password reset and quickly identify the corresponding event in Simple History by brute-forcing event IDs. Password-reset tokens expire, so timing is important but feasible for a motivated attacker. No special tools or zero-day knowledge are required; the attack is straightforward REST API manipulation. The barrier to entry (Subscriber access + experimental features enabled) is lower than for many privilege-escalation flaws, but still requires some setup. This vulnerability is not currently tracked in CISA's KEV catalog.

Remediation

Update Simple History to a patched version once released by the plugin developers (verify against their official advisory). As an immediate temporary measure on affected sites, disable the simple_history_experimental_features_enabled option in the WordPress database or configuration if it is enabled. Audit WordPress user roles and remove unnecessary Subscriber accounts. Consider restricting REST API access via firewall rules or a Web Application Firewall (WAF) to limit external REST requests to trusted IP ranges. Monitor password-reset events and unexpected administrator login sessions for signs of compromise. If an administrator account has been compromised, revoke all sessions, audit database changes, and scan for malware.

Patch guidance

A patch should be available from the Simple History plugin developers. Check the official plugin repository and security advisory for the updated version number and apply it immediately through the WordPress admin dashboard or via command line (wp plugin update simple-history). After patching, verify the update in the Installed Plugins list. On shared hosting, ensure your hosting provider supports timely plugin updates. If automatic updates are enabled, the patch should deploy automatically; verify completion. Do not rely on the experimental features option as a permanent workaround; patching is the correct fix.

Detection guidance

Search your WordPress database for simple_history_experimental_features_enabled option value 'yes' or '1' to identify affected configurations. Enable WordPress access logging and monitor /wp-json/simple-history/v1/events/* POST requests, especially those containing _fields=context parameters from low-privilege user accounts. Log authentication events and flag unexpected administrator password resets followed by new login sessions from unusual IP addresses. Use WordPress security plugins (Wordfence, Sucuri) to alert on brute-force login attempts or unusual REST API activity. Review WordPress user lists for inactive or suspicious Subscriber accounts that may have been created by attackers.

Why prioritize this

This vulnerability warrants immediate attention despite experimental features being non-default. A CVSS score of 7.5 (HIGH) reflects the high impact (full account takeover) and the moderate access requirements. The ease of exploitation once the preconditions are met (REST API + Subscriber account + experimental flag) means this will be an attractive target once publicly disclosed. Organizations should assume exploit code will be developed or released quickly. Remediation is straightforward (patching or disabling experimental features), making this a high-priority candidate for rapid response and communication to affected stakeholders.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects Attack Vector: Network (the REST endpoint is remotely accessible), Attack Complexity: High (password-reset timing and event ID brute-forcing add friction), Privileges Required: Low (Subscriber account needed), User Interaction: None (no social engineering required), and Scope: Unchanged (impact confined to the target WordPress instance). Confidentiality, Integrity, and Availability are all rated High because a compromised administrator account grants full read, modify, and delete access. The score appropriately reflects the real-world risk of administrative account takeover via a chained attack (REST disclosure + password reset), though the non-default experimental features option prevents this from being scored higher.

Frequently asked questions