CVE-2026-11907: Stream <= 4.2.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via Heartbeat API
The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to access all Stream activity records via the Heartbeat API.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/streamto a version that resolves this vulnerability.Fixed in 4.2.0 - Compensating control
Restrict access to the Stream Heartbeat API endpoint so only authorized users can retrieve Stream activity records (e.g., via web server/WAF/API gateway authorization controls) until the plugin is upgraded.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11907?
CVE-2026-11907 has a medium severity score of 6.5.
What is the impact of CVE-2026-11907?
CVE-2026-11907 allows authenticated attackers with subscriber-level access to disclose sensitive information via the Heartbeat API.
How do I fix CVE-2026-11907?
To fix CVE-2026-11907, update the Stream plugin for WordPress to version 4.2.1 or later.
Who is affected by CVE-2026-11907?
Any WordPress site using the Stream plugin version 4.2.0 or earlier is affected by CVE-2026-11907.
What is the nature of the vulnerability in CVE-2026-11907?
CVE-2026-11907 is an authorization bypass vulnerability that lacks proper verification of user permissions.