CVSS
6.5
CVSS v3.1
EPSS
0.2%
Exploit Prediction Score
Published
August 7, 2026
Exploitability
EPSS probability 0.2%
The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to access all Stream activity records via the Heartbeat API.
No package data available.
Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).