CVE-2026-11907 is an authorization bypass vulnerability in the Stream – Activity Log & Audit Trail WordPress plugin. The plugin fails to properly verify user authorization for actions related to accessing activity logs. As a result, any authenticated user with subscriber-level privileges or above can retrieve all Stream activity records through the Heartbeat API. This vulnerability affects all versions up to and including 4.2.0. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An attacker with subscriber-level access or higher can bypass authorization controls to view all activity log records maintained by the Stream plugin. This exposure of potentially sensitive audit trail data could lead to information disclosure. The vulnerability does not affect integrity or availability but compromises confidentiality of activity logs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access where possible and monitor for updates from the vendor regarding patches or official mitigations.