CVE-2026-16547 Overview
CVE-2026-16547 is a broken access control vulnerability [CWE-284] in the REST API Log WordPress plugin before version 1.7.1. The plugin fails to bind the download token to a specific log entry and does not verify the capability of the requester. An unauthenticated attacker who obtains any valid token can download logged REST API requests and responses for any entry stored by the plugin. Logged data may include credentials, authentication tokens, and private content transmitted through the WordPress REST API.
Critical Impact
Unauthenticated attackers holding any valid log-download token can exfiltrate arbitrary REST API log entries containing credentials, authentication tokens, and private content.
Affected Products
- REST API Log WordPress plugin versions prior to 1.7.1
- WordPress sites with the plugin installed and REST API logging enabled
- Any WordPress deployment exposing plugin log-download endpoints to the network
Discovery Timeline
- 2026-08-04 - CVE-2026-16547 published to the National Vulnerability Database
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2026-16547
Vulnerability Analysis
The REST API Log plugin records inbound REST API requests and their responses for auditing purposes. It exposes a log-download feature protected by a token. The plugin issues the token generically rather than binding it to a specific log entry identifier. It also omits a current_user_can() capability check on the download handler. An attacker in possession of any token issued by the plugin can request the log record of any entry.
Because logged payloads frequently contain authentication material submitted to the REST API, disclosure grants attackers direct access to secrets. Compromised credentials or session tokens can then be replayed against the same WordPress site or downstream services. The EPSS score is 0.246%, but the confidentiality impact per exposed entry is high.
Root Cause
The root cause is broken access control [CWE-284]. Two independent checks are missing from the download handler. First, the token is not scoped to the log entry being requested, so it validates globally rather than per-record. Second, the handler does not evaluate the requester's WordPress capability, so authentication is not required to invoke it once a token is known.
Attack Vector
Exploitation is network-based and requires no user interaction. An attacker must obtain a valid token, which raises attack complexity. Once a token is acquired, the attacker issues HTTP requests to the download endpoint while iterating log entry identifiers. The server returns the stored request and response body for each entry regardless of ownership, authentication state, or user role.
See the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-16547
Indicators of Compromise
- Unauthenticated HTTP requests to the REST API Log plugin download endpoint from a single source across sequential entry identifiers
- Access log entries showing repeated GET requests to the plugin's log-download URL containing a token parameter
- Outbound authentication failures shortly after log-download activity, indicating credential replay from disclosed log content
Detection Strategies
- Inspect web server access logs for high-volume requests to wp-admin/admin-ajax.php or plugin-specific REST routes tied to log downloads
- Alert on unauthenticated requests that successfully retrieve non-empty responses from the plugin's download handler
- Correlate WordPress audit logs with subsequent authentication events using the same credentials observed in disclosed log entries
Monitoring Recommendations
- Enable request logging at the reverse proxy or web application firewall layer for all URIs associated with the REST API Log plugin
- Track anomalies in response size and volume from plugin endpoints to catch bulk exfiltration
- Rotate any credentials or API tokens transmitted through the WordPress REST API while the vulnerable plugin version was active
How to Mitigate CVE-2026-16547
Immediate Actions Required
- Upgrade the REST API Log plugin to version 1.7.1 or later on all affected WordPress sites
- Rotate credentials, API keys, and authentication tokens that may have been captured in plugin logs
- Purge existing plugin log entries after upgrading to eliminate residual sensitive data
Patch Information
The vendor released version 1.7.1 of the REST API Log plugin, which binds the download token to the specific log entry and enforces a capability check on the download handler. Administrators should apply the update through the WordPress plugin management console. Confirm the installed version matches or exceeds 1.7.1 after patching.
Workarounds
- Deactivate and remove the REST API Log plugin until the patched version can be installed
- Restrict access to /wp-admin/ and REST API log-download URLs to trusted IP ranges through the reverse proxy or WAF
- Disable REST API logging in the plugin configuration to prevent new sensitive data from being written to disk
# Verify installed plugin version via WP-CLI
wp plugin get rest-api-log --field=version
# Update the plugin to the patched release
wp plugin update rest-api-log --version=1.7.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
