The REST API Log WordPress plugin allows any user who knows the download token to retrieve logged REST API requests and responses for any entry. Because the plugin does not associate the token with a specific log entry and does not verify the requester's permissions, attackers can obtain logs that may contain credentials, authentication tokens, or private content. This flaw is a CWE‑284 Improper Access Control vulnerability and constitutes an unauthorized disclosure of sensitive information.

WordPress installations running the REST API Log plugin at any version prior to 1.7.1 are affected. The plugin's documentation indicates that the vulnerability exists in all releases below the 1.7.1 update, which addresses the token binding and capability checks.

The risk is amplified by the lack of an access control check; any person with a token can abuse the download endpoint. The EPSS score is less than 1% and the vulnerability is not listed in CISA KEV, and the CVSS score of 5.9 indicates medium severity. An exploit requires only the possession of a valid token; it is inferred that the token could be leaked or guessed, which would make the vulnerability feasibly exploitable in many environments where the plugin is exposed to the internet.