EUVD-2026-57868
GHSA-cw6w-j5hg-8q4c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable log read; no integrity or availability impact; high confidentiality loss matches CWE-201 sensitive data exposure.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions.
AnalysisAI
Unauthenticated sensitive data exposure in the REST API Log WordPress plugin (versions <= 1.7.1) allows any remote actor to query the plugin's log storage and retrieve recorded REST API request and response data without credentials. Reported by Patchstack and scored CVSS 7.5 (High) with AV:N/AC:L/PR:N/UI:N, the exposure is trivially reachable across the network with no authentication or user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The REST API Log plugin (version <= 1.7.1) must be installed and active on the WordPress site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 High score is well-supported by the vector metrics: AV:N (network-reachable), AC:L (no special conditions), PR:N (no authentication), UI:N (no user interaction), with C:H reflecting the potential to expose high-sensitivity logged content. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the REST API Log plugin beyond version 1.7.1 if a patched release is available from the WordPress plugin repository; the exact fixed version is not confirmed in the available data, so administrators should consult the plugin's changelog at wordpress.org/plugins/wp-rest-api-log and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-rest-api-log/vulnerability/wordpress-rest-api-log-plugin-1-7-1-sensitive-data-exposure-vulnerability) for the remediated version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all WordPress instances using REST API Log plugin and immediately disable or uninstall it; alert relevant teams and verify no unauthorized access has occurred. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Rest Api Log
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today