CVE-2026-16547 in REST API Log Plugin
Summary
by MITRE • 08/04/2026
The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests and responses of any entry, which may contain sensitive data such as credentials, authentication tokens or private content.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability in the REST API Log WordPress plugin affects versions prior to 1.7.1 and represents a critical access control flaw that undermines the security of sensitive API communication logs. This issue stems from improper token validation mechanisms where the authentication token used to protect log download functionality is not properly bound to specific log entries or user capabilities. The flaw allows any unauthenticated attacker who obtains a valid token to access arbitrary log entries regardless of their authentication status or privileges, creating a significant escalation path for potential attackers.
The technical implementation of this vulnerability demonstrates a failure in proper authorization checks and session management within the plugin's REST API logging system. When users generate tokens for accessing log files, the system does not validate whether the requesting entity has legitimate access rights to view that particular log entry or whether the token was generated for the specific resource being accessed. This weakness creates an authentication bypass scenario where tokens become universally applicable rather than contextually restricted to their intended scope.
From an operational impact perspective, this vulnerability poses severe risks to organizations relying on WordPress REST API logging for monitoring and security purposes. Attackers can exploit this flaw to extract potentially sensitive information including authentication credentials, API keys, session tokens, and private content that may be transmitted through REST API endpoints. The compromised logs could reveal attack vectors, system configurations, and user behavior patterns that would aid in further exploitation activities.
The vulnerability aligns with CWE-285 (Improper Authorization) and represents a specific instance of insufficient access control validation within web applications. According to ATT&CK framework, this weakness maps to T1078 (Valid Accounts) and T1566 (Phishing) as attackers could potentially obtain tokens through various means including social engineering or by exploiting other vulnerabilities that compromise the token generation process. The lack of proper capability checks also violates principle of least privilege concepts that should govern all access control mechanisms.
Organizations should immediately upgrade to version 1.7.1 or later of the REST API Log plugin to address this vulnerability. Additionally, administrators should review existing tokens and revoke any that may have been compromised, implement additional monitoring for unusual log access patterns, and consider implementing rate limiting on API endpoints to reduce the effectiveness of automated attacks. The fix should ensure that tokens are properly bound to specific log entries and that all access requests undergo proper capability verification before granting access to sensitive data.