CVE-2026-16547: 
WordPress vulnerability analysis and mitigation

CVE-2026-16547 is a broken access control vulnerability in the REST API Log WordPress plugin affecting all versions before 1.7.1. The flaw allows unauthenticated users who possess any valid log download token to download REST API log entries for any log record — not just the one the token was originally issued for — potentially exposing credentials, authentication tokens, and other private content. It was publicly disclosed on 2026-07-27 and assigned a CVSS score of 5.9 (Medium) (WPScan, GitHub Advisory).

The root cause is improper access control (CWE-284 / OWASP A5: Broken Access Control): the plugin's log download endpoint accepts a token parameter but neither binds that token to a specific log entry nor verifies that the requester has the appropriate WordPress capability. As a result, any token — regardless of which log entry it was originally generated for — can be used to retrieve any other log entry. An attacker who obtains even a single valid token (e.g., from a shared link, a phishing target, or a leaked URL) can enumerate and download all stored REST API request/response logs. The vulnerability was discovered and reported by researcher Shikhali Jamalzade (WPScan).

Successful exploitation results in unauthorized disclosure of sensitive data logged by the REST API Log plugin, which may include plaintext credentials, authentication tokens (e.g., JWT, OAuth tokens, API keys), and private content transmitted via the WordPress REST API. Because REST API logs can capture authentication flows and administrative operations, exposed tokens could enable account takeover or lateral movement within the WordPress environment. The impact is limited to confidentiality — there is no direct code execution or integrity impact — but the sensitivity of the data at risk elevates the practical severity (WPScan, GitHub Advisory).

1. Token Acquisition: Obtain any valid log download token for the target WordPress site. This could be achieved by receiving a shared log download link, intercepting a URL from a legitimate user, or finding a token in a publicly accessible location (e.g., cached pages, exposed logs).
2. Identify the Download Endpoint: Locate the REST API Log plugin's log download endpoint on the target WordPress installation (typically accessible via the WordPress admin AJAX handler or a dedicated REST route).
3. Manipulate the Request: Craft an HTTP request to the download endpoint, supplying the obtained token but substituting a different log entry ID (e.g., incrementing or enumerating entry IDs) to target arbitrary log records.
4. Download Arbitrary Logs: Because the plugin does not bind the token to a specific entry or check requester capabilities, the server returns the requested log entry's full REST API request and response data.
5. Extract Sensitive Data: Parse the downloaded log content for credentials, authentication tokens, API keys, or private content that can be used for account takeover or further attacks (WPScan).

• Network: Unusual or repeated unauthenticated HTTP requests to the REST API Log plugin's log download endpoint with varying log entry IDs but the same token parameter; requests originating from unexpected IP addresses or automated tools (high request rate, sequential entry ID enumeration).
• Logs: WordPress access logs showing GET/POST requests to the log download endpoint from unauthenticated sessions; multiple log entries accessed using the same token value across different entry IDs.
• Application: Unexpected spikes in log download activity visible in the REST API Log plugin's admin interface; log entries for sensitive REST API operations (authentication, user management) being accessed outside of normal administrative hours.

Update the REST API Log WordPress plugin to version 1.7.1 or later, which addresses the broken access control by properly binding tokens to specific log entries and enforcing capability checks on the download endpoint (WPScan). As an immediate precaution, administrators should review and rotate any credentials, API keys, or authentication tokens that may have been captured in existing log entries. If immediate patching is not possible, consider temporarily disabling the log download feature or restricting access to the download endpoint via server-level controls (e.g., IP allowlisting or WAF rules).

The vulnerability was discovered and responsibly disclosed by researcher Shikhali Jamalzade (Twitter: @0xAlisAlive), who also submitted it to WPScan. WPScan has adopted a coordinated disclosure approach, delaying PoC publication until 2026-08-10 to provide users time to update (WPScan). No significant broader media coverage or notable community debate has been observed at this time.