Description

The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to access all Stream activity records via the Heartbeat API.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-07T05:16:57.457Z",
  "pubdate": "2026-08-07T05:16:57.457Z",
  "executiveSummary": "An authorization bypass vulnerability has been identified in the Stream plugin for WordPress, affecting all versions up to, and including, 4.2.0. The vulnerability stems from insufficient validation of user authorization before executing sensitive actions.\nThis security flaw allows authenticated attackers possessing subscriber-level access and above to improperly access and retrieve all Stream activity records via the Heartbeat API.\nThe risk implications include unauthorized disclosure of sensitive activity logs, audit trails, and potentially operational metadata managed by the Stream plugin.\nThe exploitation requirement is authenticated access, specifically a minimum of subscriber-level privileges on the targeted WordPress installation, which enables the attacker to interact with the Heartbeat API and harvest unauthorized data.",
  "technicalDetails": "The vulnerability resides within the access control logic of the Stream plugin for WordPress, specifically affecting versions up to, and including, 4.2.0. The root cause is the absence of proper capability checks and authorization verification when handling requests originating from or interacting with the WordPress Heartbeat API.\nAuthentication is required to execute the attack, but the required privilege level is minimal, restricted only to authenticated users holding subscriber-level access or higher. Because default WordPress configurations often permit open user registration resulting in subscriber roles, this widens the potential threat actor demographic.\nThe vulnerable component is the request handling mechanism that interfaces with the Heartbeat API to retrieve Stream activity records. During standard execution, the endpoint fails to validate whether the requesting user possesses administrative or appropriate viewing capabilities for plugin logs.\nThe attack flow proceeds as follows: First, the authenticated attacker establishes a session with subscriber-level privileges on the WordPress site. Second, the attacker constructs an HTTP request targeted at the WordPress Heartbeat API endpoint, designed to trigger the retrieval of Stream activity records. Third, because the Stream plugin fails to perform rigorous authorization checks against the requesting user's role, the backend processes the request and queries the database for logging data. Finally, the server serializes and returns all Stream activity records in the API response, granting the low-privileged attacker unauthorized visibility into system activity logs.\nPost-exploitation impact is characterized by the unauthorized exposure of comprehensive activity logs. This data may reveal administrative actions, user metadata, internal system modifications, and other sensitive operational intelligence captured by the Stream plugin, facilitating further reconnaissance against the WordPress environment."
}