The Logtivity plugin for WordPress contains a logic defect in its verifyAuthorization function. When a request arrives without an Authorization header, the plugin bypasses token checks and returns true, effectively skipping all authentication. This allows an unauthenticated attacker to call the /wp-json/logtivity/v1/options endpoint and retrieve full plugin configuration, including the logtivity_site_api_key used to impersonate the site in external Logtivity API calls.

Affected products are the Logtivity Activity Logs, User Activity Tracking, Multisite Activity Log plugin versions up to and including 3.3.6. Versions 3.3.7 and later contain the fix.

Based on the description, the vulnerability can be exploited by sending unauthenticated HTTP requests to a publicly accessible REST endpoint; thus the likely attack vector is network access. The CVSS score of 5.3 indicates moderate severity. Because the REST endpoint is reachable without authentication, attackers can obtain the plugin’s configuration options, including the logtivity_site_api_key, which can then be used to impersonate the site in external API calls. EPSS is not available, so we cannot quantify exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog. The combination of moderate severity and public network exposure makes this issue actionable for threat actors.