CVE-2026-16547 describes an improper access control vulnerability (CWE-284) in the REST API Log WordPress plugin prior to version 1.7.1. The vulnerability arises because the token used to protect the log download feature is not bound to the specific log entry requested, and the plugin fails to check the requester's permissions. Consequently, an unauthenticated attacker with any valid token can download logs containing REST API requests and responses, which may include sensitive information like credentials and authentication tokens.

An attacker who obtains any valid token for the log download feature can access REST API logs for any entry without authentication or authorization checks. This exposure may lead to disclosure of sensitive data such as credentials, authentication tokens, or private content contained within the logs. The vulnerability has a CVSS 3.1 base score of 5.9 (medium severity), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 1.7.1, upgrading to version 1.7.1 or later is recommended once confirmed by the vendor. Until a patch is available, restrict access to the log download feature and monitor for unauthorized token usage.