This vulnerability is an insertion of sensitive information into the data sent by the plugin’s logs, allowing an attacker to retrieve embedded sensitive data. The weakness is a classic data exposure flaw, aligning with the CWE-201 category. As a result, any entity that has access to the activity logs can view confidential information that should not be visible, potentially leaking credentials, personal data, or other secrets.

The Logtivity Activity Logs, User Activity Tracking, Multisite Activity Log plugin, versions up to and including 3.3.6, is affected. All WordPress sites that have installed this plugin within this version range are at risk. No specific WordPress core version is mentioned, so the vulnerability applies broadly to any WordPress instance using a vulnerable plugin release.

The reported CVSS score of 7.5 indicates a high severity. EPSS data is unavailable, but the vulnerability is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation yet. The attack vector is not disclosed in the description; however, it is reasonable to infer that an attacker would need (or be able to obtain) access to the activity logs, which may be visible to authenticated users or potentially to all visitors depending on plugin configuration. Once accessed, the sensitive information can be exfiltrated by the attacker.