REST API Log CVE-2026-100514

No special conditions beyond deployment - remote unauthenticated exploitation (PR:N/UI:N) against default configurations of the REST API Log WordPress plugin at version 1.7.2 or earlier. The only practical prerequisites are that the plugin is installed and active and that log entries exist to retrieve. Limiting factors: impact is confidentiality-only (C:H, no integrity/availability), the exposed data's sensitivity depends on what REST traffic the site logged, and the plugin's niche install base narrows the realistic target population; no authentication, special protocol, or non-default setting is required.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5 HIGH) is internally consistent and credible for an unauthenticated IDOR: network-reachable, low complexity, no privileges, no user interaction, with high confidentiality impact and no integrity/availability effect. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are therefore mixed: the technical severity is genuinely high (trivially exploitable data exposure on default configs) but the real-world priority is tempered by the product's niche footprint and the absence of exploitation telemetry. This is a legitimate but moderate-priority issue - patch/remove on affected sites, but it is not a mass-exploitation emergency on the available evidence. Note the single source: all data traces to one Patchstack database entry, with no NVD enrichment, no vendor advisory, and no confirmed fixed version.

An unauthenticated attacker discovers a WordPress site running the REST API Log plugin (<=1.7.2) and sends requests to its log-retrieval endpoint, substituting or enumerating the object/ID reference that identifies stored log entries. Because the plugin does not verify authorization/ownership for the requested reference, it returns logged REST API request and response records that may contain authentication tokens, PII, or credentials captured in headers and bodies. No POC is published, but the attack requires only basic HTTP request manipulation given AV:N/AC:L/PR:N.