CVE-2026-11907 — Threat Intelligence Report

Executive Summary

CVE-2026-11907 is an authorization bypass vulnerability in the Stream plugin for WordPress, affecting all versions up to and including 4.2.0. The plugin fails to properly verify that a user is authorized to perform a specific action, allowing authenticated attackers with subscriber-level access to retrieve all Stream activity records through the Heartbeat API. This results in unauthorized disclosure of sensitive activity log data to low-privileged users, with a CVSS score of 6.5 (Medium severity) due to High confidentiality impact.

The vulnerability exploits the WordPress Heartbeat API as an attack vector, enabling attackers who have obtained any authenticated account — even with minimal subscriber privileges — to enumerate and exfiltrate the complete activity history of the WordPress installation. Given that no patch is currently available, all WordPress sites running the affected version remain exposed to this information disclosure risk.

Technical Analysis

The Stream plugin for WordPress provides comprehensive activity logging, recording user actions, content modifications, plugin installations, configuration changes, and other administrative activities. These activity records can include sensitive information such as administrator usernames, IP addresses, user agent strings, content authorship, and system-level modifications.

The vulnerability stems from an authorization bypass in the plugin's implementation of the Heartbeat API integration. WordPress's Heartbeat API is designed to enable real-time communication between the browser and the server through periodic Ajax requests, typically sent every 15-60 seconds while the administrative dashboard is open.

The plugin registers a callback handler for Heartbeat API requests to push recent activity records to connected clients. However, the callback function fails to implement proper permission checks — specifically, it does not verify that the current user has the required capability (such as manage_options or view_stream) before processing the request and returning activity data.

The Heartbeat API endpoint is accessible to any authenticated WordPress user. When a user with subscriber-level access sends a Heartbeat request with the appropriate action parameter, the plugin's callback executes and returns the full set of Stream activity records without validating the requester's authorization level.

The core issue is that the plugin relies on the assumption that only administrative users would interact with the Heartbeat API for activity retrieval, but fails to actively enforce this constraint. This is a classic example of a missing authorization check (CWE-862) — the plugin does not implement a capability check before executing the action.

The confidentiality impact is High (C:H in the CVSS vector) because the exposed activity logs contain sensitive operational data: administrator account names, login timestamps, IP addresses, content editorial history, plugin/theme changes, and potentially security-related events recorded by the site.

Exploitation Scenarios

Attack Chain:

1. Reconnaissance & Target Identification: The attacker identifies WordPress sites running the Stream plugin. This can be accomplished through fingerprinting techniques — examining page source for Stream plugin assets, detecting the plugin's activity log tables in exposed database dumps, querying the WordPress plugin API for sites reporting Stream as an installed plugin, or using Shodan to search for WordPress sites with Stream-related content in HTTP responses.

2. Account Acquisition: The attacker obtains valid credentials for a subscriber-level account. This could be achieved through:

   • Registration abuse (if open registration is enabled on the target)
   • Credential stuffing using previously leaked passwords from other breaches
   • Phishing campaigns targeting site users
   • Purchasing credentials from underground forums where WordPress account dumps are traded

3. Trigger/Weaponization: With subscriber credentials in hand, the attacker authenticates to the WordPress dashboard (/wp-admin/). Once authenticated, they craft a Heartbeat API request using either:

   • A custom API client that sends a POST request to the Heartbeat AJAX endpoint with the required nonce and action parameters
   • A modified JavaScript console script executed in the browser while logged in

   The request must include the WordPress nonce for Heartbeat operations and specify the action that triggers the plugin's activity retrieval callback.

4. Payload/Execution: The crafted request causes the plugin's Heartbeat callback to execute without proper authorization checks. The callback fetches all Stream activity records from the database and returns them in the API response. The attacker receives the complete activity log — potentially containing thousands of entries.

5. Post-Exploitation: The attacker parses the disclosed data to extract:

   • Administrator usernames for targeted phishing or brute-force campaigns
   • IP addresses of site operators for potential physical/LAN-based attacks
   • Content review/scheduled content information for competitive intelligence
   • Security plugin configurations and logging behaviors to plan evasion
   • Plugin/theme upgrade history to identify other vulnerable components

This entire process requires no special tools beyond the attacker's browser and network intercepting proxy, and the exploitation is silent — the attacker's actions appear as normal Heartbeat API traffic, which is generated by every authenticated WordPress session by default.

Impact Assessment

Business Impact: The vulnerability allows any authenticated user to access the site's complete activity log. This constitutes a serious breach of the principle of least privilege and can expose:

• Operational Intelligence: All administrative actions, content workflows, and scheduled operations become visible to unauthorized users.
• User Privacy: IP addresses, usernames, and behavioral patterns of all site users are disclosed.
• Security Posture Exposure: Reveals which security measures are in place, what monitoring exists, and where the gaps are — directly aiding further attacks.
• Regulatory Compliance: If the WordPress site handles PII (personal data), this vulnerability may constitute a reportable data breach under GDPR, CCPA, or other privacy regulations.

Affected Systems: All WordPress installations running the Stream plugin version 4.2.0 or earlier. This includes both self-hosted sites and managed WordPress environments where the plugin is deployed.

Blast Radius: CVSS subscores indicate: Attack Vector = Network (V:N), Attack Complexity = Low (AC:L), Privileges Required = Low (PR:L), User Interaction = None (UI:N), Confidentiality = High (C:H), Integrity = None (I:N), Availability = None (A:N).

The vulnerability is remotely exploitable with low complexity and requires only subscriber-level credentials. The confidentiality impact is rated High, meaning a complete loss of confidentiality is possible. The integrity and availability impacts are none, meaning the attacker can only read data, not modify or destroy it. The effective exploitability is high because subscriber-level accounts are the easiest to obtain on WordPress sites with open registration or through credential stuffing attacks.

Detection Guidance

Sigma Rule

title: WordPress Stream Plugin Heartbeat API Authorization Bypass
id: f3a8b2d4-7c5e-4a1b-9d3f-6e8c2a5b9d1f
status: experimental
description: Detects subscriber-level users accessing Stream activity records via WordPress Heartbeat API
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-11907
author: Valtersit Security Team
date: 2026/01/15
tags:
    - attack.credential-access
    - attack.collection
    - cve.2026.11907
logsource:
    category: web
    product: wordpress
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains:
            - admin-ajax.php
        cs-user-agent|contains:
            - WordPress
        http.response.status_code: 200
        cs-referer|contains:
            - wp-admin
    filter_subscriber:
        cs-username|contains:
            - subscriber
    condition: selection and not filter_subscriber
level: high
falsepositives:
    - Legitimate subscriber users with custom roles granted extended capabilities
    - Compatibility with third-party plugins that legitimately extend subscriber permissions

YARA Rule

rule WordPress_Stream_CVE_2026_11907
{
    meta:
        author = "Valtersit Security Team"
        description = "Detects exploit patterns for WordPress Stream plugin authorization bypass"
        reference = "CVE-2026-11907"
        date = "2026-01-15"
        severity = "medium"
    
    strings:
        $heartbeat_action = "heartbeat" ascii nocase
        $stream_action = "stream" ascii nocase
        $activity_record = "activity" ascii nocase
        $stream_ajax = "stream_heartbeat" ascii nocase
        $wp_nonce = "_wpnonce" ascii nocase
        $subscriber_user = "subscriber" ascii nocase
    
    condition:
        uint16(0) == 0x0D0A and
        (
            $heartbeat_action and
            $stream_action and
            $activity_record and
            $wp_nonce
        ) or
        (
            $stream_ajax and
            $wp_nonce and
            $subscriber_user
        )
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET WEB_SPECIFIC_APPS WordPress Stream Plugin Heartbeat API Authorization Bypass (CVE-2026-11907)";
    flow:established,to_server;
    http.method;
    content:"POST";
    http.uri;
    contains:"admin-ajax.php";
    http.client_body;
    contains:"action=heartbeat";
    http.client_body;
    contains:"stream";
    reference:cve,2026-11907;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-11907;
    classtype:attempted-recon;
    sid:100000001;
    rev:1;
    metadata:created_at 2026_01_15, updated_at 2026_01_15, signature_severity Major, cve CVE-2026-11907;
)

Note: The above signature should be tuned based on the specific HTTP body parameters used by the plugin's Heartbeat integration. Network-level detection is challenging because Heartbeat traffic is legitimate for all authenticated WordPress sessions; the distinguishing factor is the subscriber role, which is not visible in network traffic alone.

Elastic Detection

// Detection for WordPress Stream plugin Heartbeat API exploitation attempts
// Adjust for your specific event structure

authentication where process.name : "wp" or event.module : "wordpress" or event.category : "authentication"
  and event.action in ("login", "authentication_success")
  and winlog.event_data.TargetUserName : "*subscriber*"
  or (
    // Detect unusual Heartbeat traffic patterns
    network where network.protocol : "http"
      and url.path : "*/admin-ajax.php"
      and url.extension : "php"
      and http.request.method : "POST"
      and user.roles : "*subscriber*"
      and user.name : "*subscriber*"
  )

Splunk SPL Query

index=wordpress sourcetype=access_combined 
| search "admin-ajax.php" AND "heartbeat" AND "stream" AND status=200
| eval indb=if(match(uri,".*stream.*heartbeat.*") OR match(form_data,".*action=heartbeat.*"),1,0)
| where indb=1
| rex field=user "^(?<username>[^@]+)"
| lookup wp_users username OUTPUT role
| where role IN ("subscriber", "contributor", "editor")
| stats count earliest(_time) latest(_time) BY src_ip, username, uri
| table src_ip, username, uri, count, earliest, latest
| sort - count

Wazuh OSSEC Rule

<group name="wordpress,">
    <rule id="100237" level="10">
        <decoded_as>json</decoded_as>
        <field name="url">admin-ajax.php</field>
        <field name="action">heartbeat</field>
        <field name="user_role">subscriber</field>
        <description>WordPress Stream plugin auth bypass (CVE-2026-11907): Subscriber-level user accessing Heartbeat API with Stream data</description>
        <mitre><id>T1005</id><ref>https://attack.mitre.org/techniques/T1005/</ref></mitre>
        <group>cve-2026-11907</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Status: No vendor patch available. Patch confidence is 0/4 — no evidence of a fix from any tracked source. All versions up to and including 4.2.0 are vulnerable.

1) Immediate Mitigations:

• Restrict Subscriber Access: Disable user self-registration on WordPress sites (Settings → General → Membership — uncheck "Anyone can register").
• Audit Existing Accounts: Review all subscriber-level accounts and remove any that are not actively required.
• Limit Heartbeat API Usage: Consider utilizing a WordPress optimization plugin that restricts or disables the Heartbeat API for non-admin users. This reduces the attack surface without breaking core functionality.
• Implement IP Allowlisting: For internal/intranet WordPress deployments, configure server-level access controls (e.g., .htaccess or nginx configuration) to restrict access to /wp-admin/admin-ajax.php to trusted IP ranges.
• Deploy a WAF: Use a Web Application Firewall with WordPress-specific rules to flag or block anomalous Heartbeat API requests containing Stream plugin parameters from non-admin accounts.
• Disable the Plugin: If administrative activity logging is not critical, disable and remove the Stream plugin entirely.

2) Patch/Upgrade Steps:

• Monitor the WordPress Plugin Directory and the Stream plugin's official repository for a version newer than 4.2.0.
• When a patched version (4.2.1 or later) is released, immediately update the plugin via WordPress Dashboard → Plugins → Update, or through WP-CLI using: wp plugin update stream
• After updating, verify the fix by testing with a subscriber-level account that the Stream activity records are no longer accessible via the Heartbeat API.
• Until a patch is available, the plugin should be considered actively vulnerable and its continued use should be a risk-accepted decision by the organization.

3) Long-Term Hardening:

• Implement a formal plugin update lifecycle policy requiring security patches to be applied within 48 hours of release.
• Maintain an inventory of installed WordPress plugins and map them against CVE databases weekly.
• Use the principle of least privilege — ensure no user has more WordPress capabilities than their role requires.
• Implement WordPress security best practices: strong password policies, two-factor authentication (2FA) for all users, and regular security audits.
• Consider using a WordPress security monitoring service that aggregates plugin vulnerabilities and provides early warning alerts.
• Segment WordPress administration interfaces behind VPN or access-controlled networks where possible.

References

1. NVD Entry for CVE-2026-11907: https://nvd.nist.gov/vuln/detail/CVE-2026-11907
2. WordPress Plugin Repository — Stream: https://wordpress.org/plugins/stream/
3. Wordfence Vulnerability Database Reference (typical CNA for WordPress plugins): https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/stream/
4. MITRE ATT&CK — Data from Information Repositories (T1213): https://attack.mitre.org/techniques/T1213/
5. OWASP — Missing Function Level Access Control (Broken Access Control): https://owasp.org/www-project-top-ten/2017/A5_2017-Broken_Access_Control

Threat Actor Campaigns / Exploitation in the Wild: No evidence of large-scale threat actor exploitation exists at publication time. The vulnerability class (CWE-862 — Missing Authorization) is commonly targeted in WordPress attack campaigns, and given the public PoC status, active exploitation attempts against unpatched installations are considered highly likely. Enterprise SOC teams should treat this vulnerability as actively exploitable and prioritize detection monitoring accordingly.