What is the CVSS score of EUVD-2026-57868?

EUVD-2026-57868 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of REST API Log are affected by EUVD-2026-57868?

The REST API Log WordPress plugin (versions ≤1.7.1) exposes sensitive API request and response data to any unauthenticated remote user without credentials or user interaction.

How to fix or mitigate EUVD-2026-57868?

Within 24 hours: inventory all WordPress instances using REST API Log plugin and immediately disable or uninstall it; alert relevant teams and verify no unauthorized access has occurred. Within 7 days: audit available plugin logs for unauthorized query activity prior to plugin removal, review REST API logs for evidence of sensitive data exposure, and implement network or WAF-level restrictions on plugin endpoints. Within 30 days: monitor Patchstack and plugin repository channels for vendor patches, evaluate alternative logging solutions with built-in access control, and deploy automated scanning to prevent re-installation of versions ≤1.7.1.

REST API Log EUVD-2026-57868

| CVE-2026-66443 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-08-13 Patchstack

GHSA-cw6w-j5hg-8q4c

WordPress Information Disclosure Wordpress Plugin Rest Api Log

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable log read; no integrity or availability impact; high confidentiality loss matches CWE-201 sensitive data exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:37 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions.

AnalysisAI

Unauthenticated sensitive data exposure in the REST API Log WordPress plugin (versions <= 1.7.1) allows any remote actor to query the plugin's log storage and retrieve recorded REST API request and response data without credentials. Reported by Patchstack and scored CVSS 7.5 (High) with AV:N/AC:L/PR:N/UI:N, the exposure is trivially reachable across the network with no authentication or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The REST API Log plugin (CPE: cpe:2.3:a:pete_nelson:rest_api_log:*:*:*:*:*:*:*:*, developed by Pete Nelson) is a WordPress utility that records incoming WordPress REST API requests and their responses for debugging and auditing purposes. CWE-201 ('Insertion of Sensitive Information Into Sent Data') identifies the root cause: the plugin exposes its accumulated log data through an accessible REST API endpoint without enforcing authentication or authorization checks. Logged entries may contain HTTP request headers (including Authorization or Cookie values), query parameters, POST body payloads, and full API response bodies - any of which can contain credentials, session tokens, or application data depending on site activity. The vulnerability resides in the plugin's failure to restrict read access to its own log store at the WordPress REST API layer.

RemediationAI

Update the REST API Log plugin beyond version 1.7.1 if a patched release is available from the WordPress plugin repository; the exact fixed version is not confirmed in the available data, so administrators should consult the plugin's changelog at wordpress.org/plugins/wp-rest-api-log and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-rest-api-log/vulnerability/wordpress-rest-api-log-plugin-1-7-1-sensitive-data-exposure-vulnerability) for the remediated version. If no patched version is yet available, the safest compensating control is to deactivate or uninstall the plugin, accepting the trade-off of losing REST API audit log visibility. Alternatively, if the plugin is required for operational purposes, restrict network access to the WordPress REST API log endpoint via server-level rules (e.g., Nginx/Apache access control or WAF rules blocking unauthenticated GET requests to the relevant REST route) - note this introduces maintenance overhead and may not cover all access paths depending on hosting configuration.