Vulnerability · Published Aug 4, 2026 · Assigned by WPScan

CVE-2026-16547REST API Log < 1.7.1 - Unauthenticated Sensitive Log Data Disclosure via Download Endpoint

Medium 5.9

In plain English

A medium-severity improper access control in REST API Log from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.4%top 67.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests and responses of any entry, which may contain sensitive data such as credentials, authentication tokens or private content.

Affected products (as reported)

Vendor	Product	Versions
Unknown	REST API Log	0 – before 1.7.1

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://wpscan.com/vulnerability/373d040f-0361-4b09-9655-34d415e2c49e/ exploit, vdb-entry, technical-description