Threats tagged 'ghsa-5v73-chf6-5qjj'

The REST API Log WordPress plugin before version 1.7.1 has an improper access control vulnerability in its log download feature. The plugin does not bind the token protecting log downloads to the specific log entry nor verify the requester's capabilities. This allows unauthenticated users who possess any valid token to download REST API request and response logs, potentially exposing sensitive data such as credentials and authentication tokens.