The Simple History plugin for WordPress suffers from an authenticated account takeover vulnerability (CVE-2026-7459) due to weak permission enforcement on event reaction endpoints (react_to_event() / unreact_to_event()). These endpoints use get_items_permissions_check() which only verifies that the user is logged in, without enforcing per-logger capability checks. Consequently, a Subscriber-level user can POST to the reaction endpoint with specific parameters to read the full context of any event, including password reset emails logged by SimpleUserLogger. By triggering a password reset for an administrator and enumerating event IDs, the attacker can extract the reset key from the logged event and complete the password reset process, gaining administrator access. Exploitation requires the experimental features option (simple_history_experimental_features_enabled) to be enabled by an administrator, which is off by default. No official patch or remediation guidance has been published as of the data provided.

Successful exploitation allows an authenticated low-privilege user (Subscriber) to take over administrator accounts by obtaining password reset links from logged events. This results in full compromise of the WordPress site, including confidentiality, integrity, and availability impacts as reflected in the CVSS score of 7.5 (High). The vulnerability requires the experimental feature to be enabled, limiting exposure to some extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should ensure that the experimental features option (simple_history_experimental_features_enabled) remains disabled to prevent exploitation. Restricting Subscriber-level users from accessing the event reaction endpoints or disabling the Simple History plugin temporarily may also reduce risk.