REST API Log < 1.7.1 – Unauthenticated Sensitive Log Data Disclosure via Download Endpoint | CVE 2026-16547

Description

The plugin does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests and responses of any entry, which may contain sensitive data such as credentials, authentication tokens or private content.

Proof of Concept

1. As any authenticated user (even one with minimal privileges), navigate to any log entry's view page in wp-admin:
   /wp-admin/tools.php?page=wp-rest-api-log-view-entry&id=<any_entry_id>

2. Copy the "Download" link for "Response Body" (or any other property). It will look like:
   /wp-json/wp-rest-api-log/entry/<id>/response/body/download?hash=<HASH>

3. From a completely unauthenticated context (e.g. a private/incognito browser window, or plain curl with no cookies), request the SAME hash against a DIFFERENT, arbitrary log entry ID:

   curl -i "https://TARGET/wp-json/wp-rest-api-log/entry/<OTHER_ID>/response/body/download?hash=<HASH>"

4. The server returns HTTP 200 with the full logged response body for <OTHER_ID>, despite no authentication cookie/session being sent and the hash having been generated for a completely different entry ID.

Tested and confirmed on version 1.7.0 in an isolated Docker WordPress test environment.