EUVD-2026-52600
GHSA-5v73-chf6-5qjj
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
AV:N for web-accessible endpoint; AC:H because attacker must first acquire any valid token before exploiting BOLA; PR:N as no WordPress account is required; C:H for potential credential and token exposure; I:N and A:N as the flaw is read-only.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests and responses of any entry, which may contain sensitive data such as credentials, authentication tokens or private content.
AnalysisAI
Broken object-level authorization in the REST API Log WordPress plugin (all versions before 1.7.1) permits unauthenticated attackers who hold any valid log-download token - regardless of which entry it was issued for - to retrieve arbitrary log entries from any other user, exposing stored credentials, authentication tokens, and private REST API payloads. The root cause is twofold: tokens are not cryptographically bound to specific log entry IDs, and the plugin performs no WordPress capability check on the requester. A public exploit PoC is referenced via WPScan, though EPSS at 0.18% and SSVC exploitation status of 'none' indicate no confirmed widespread abuse at time of analysis.
Technical ContextAI
The affected component is the REST API Log WordPress plugin (CPE: cpe:2.3:a:unknown:rest_api_log:*:*:*:*:*:*:*:*), versions 0 through pre-1.7.1. The plugin captures incoming WordPress REST API requests and their full responses - payloads which routinely include API keys, session tokens, and form-submitted credentials - and exposes them via a token-gated download endpoint. The flaw is classified under CWE-284 (Improper Access Control) and is specifically a broken object-level authorization (BOLA) pattern: the log entry ID is user-supplied in the download request, but the server validates only whether the caller holds any token, never whether that token corresponds to the requested entry, and never whether the caller holds a WordPress capability (role) permitting log access. This means a token legitimately obtained for entry #1 can freely be reused to download entry #500 or any other entry by ID.
RemediationAI
Update the REST API Log WordPress plugin to version 1.7.1 or later, which introduces per-entry token binding and enforces WordPress capability checks on log download requests; the patch is confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/373d040f-0361-4b09-9655-34d415e2c49e/. If immediate patching is not feasible, disable the log download feature within the plugin's settings to eliminate the exposed endpoint entirely - this prevents log retrieval without affecting logging itself, though it also removes legitimate download access. As an additional compensating control, restrict external HTTP access to the WordPress REST API log download endpoint at the web server or WAF layer, limiting requests to authenticated administrator IPs only; note this may break legitimate remote integrations that consume those logs. Administrators should also audit existing log contents for sensitive data exposure and rotate any credentials or tokens that may have been captured in REST API payloads.
More in Rest Api Log
View allSame weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today