CVE-2026-8198 affects the Logtivity WordPress plugin's Activity Logs, User Activity Tracking, and Multisite Activity Log components up to version 3.3.6. The vulnerability arises from a logic flaw in the verifyAuthorization method where requests lacking an Authorization header skip Bearer token validation and are incorrectly granted access. This flaw enables unauthenticated attackers to access the /wp-json/logtivity/v1/options REST API endpoint and retrieve sensitive plugin configuration data, including the logtivity_site_api_key. This key can be leveraged to impersonate the affected site in API interactions with the Logtivity service. The issue is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and has a CVSS 3.1 base score of 5.3 (medium severity). There is no vendor-provided patch or official remediation information at this time.

An unauthenticated attacker can bypass authentication checks and access sensitive configuration information from the Logtivity plugin, including the site API key. Exposure of the logtivity_site_api_key could allow the attacker to impersonate the affected site in API calls to the Logtivity service, potentially leading to unauthorized actions or data disclosure via the service. The vulnerability does not directly impact integrity or availability but compromises confidentiality of sensitive plugin data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /wp-json/logtivity/v1/options REST API endpoint via web server or firewall rules to prevent unauthenticated access. Monitor vendor channels for updates and apply patches promptly once released.