The Stream plugin for WordPress contains an authorization bypass that allows any authenticated user with subscriber-level permissions or higher to read all activity logs through the Heartbeat API. Because the plugin does not verify that the caller is authorized to view the data, sensitive event information can be exposed, resulting in a successful disclosure of potentially confidential activity records. The weakness is classified as CWE‑862, Privilege Escalation due to Improper Authorization.

The vulnerability affects the Stream – Activity Log & Audit Trail WordPress plugin, specifically all releases up to and including version 4.2.0. Sites that have installed this plugin on any WordPress instance without patching are exposed. No partial versions are listed; any installation of 4.2.0 or older is vulnerable.

The CVSS score of 6.5 indicates a moderate severity, and the vulnerability is exploitable by any authenticated subscriber user via the web interface. Exploitation requires only a valid login; no additional privileges beyond subscriber level are necessary. Because the Heartbeat API is publicly accessible to authenticated users, an attacker can send HTTP requests to retrieve the full activity log. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The attack vector is web application and is therefore likely to be exploited if the site has adequate user registrations. There is no mention of a publicly available exploit, but the lack of authorization checking makes exploitation straightforward for anyone with an account.