CVE-2026-11907 is an authorization bypass vulnerability in the Stream – Activity Log & Audit Trail WordPress plugin. The plugin fails to properly verify user authorization for accessing activity records, enabling authenticated users with minimal privileges (subscriber-level and above) to retrieve all Stream activity logs through the Heartbeat API. This issue affects all versions up to and including 4.2.0. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily on confidentiality. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

An attacker with subscriber-level access or higher can bypass authorization controls to view all activity log records maintained by the Stream plugin. This results in a confidentiality breach of potentially sensitive audit trail data. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor for updates from the vendor. No official remediation or temporary fix has been documented at this time.