CVE-2026-16547

Name of the Vulnerable Software and Affected Versions REST API Log WordPress plugin versions prior to 1.7.1

Description The plugin fails to bind the token protecting the log download feature to the specific log entry being requested and does not verify the requester's capabilities. This allows unauthenticated users who possess a valid token to download logged REST API requests and responses for any entry. Such logs may contain sensitive information, including credentials, authentication tokens, or private content.

Recommendations Update the REST API Log WordPress plugin to version 1.7.1 or later.