CVE-2026-16547 REST API Log < 1.7.1 - Unauthenticated Sensitive Log Data Disclosure via Download Endpoint
Unauthenticated attackers can download sensitive REST API logs containing credentials and tokens due to missing authorization checks in the download endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-16547?
CVE-2026-16547 is a medium-severity missing authorization vulnerability in Unknown REST API Log, published on 4 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests and responses of any entry, which may contain sensitive data such as credentials, authentication tokens or private content.
Weakness: CWE-284
Which versions are affected by CVE-2026-16547?
How do I fix CVE-2026-16547?
No fix has been published for CVE-2026-16547 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-16547 being exploited?
There is no known exploitation of CVE-2026-16547 in the wild and no public exploit code.
Sources
Also known as GHSA-5v73-chf6-5qjj.