The REST API Log WordPress plugin allows any user who knows the download token to retrieve logged REST API requests and responses for any entry. Because the plugin does not associate the token with a specific log entry and does not verify the requester's permissions, attackers can obtain logs that may contain credentials, authentication tokens, or private content. This flaw constitutes an unauthorized disclosure of sensitive information.

WordPress installations running the REST API Log plugin at any version prior to 1.7.1 are affected. The plugin's documentation indicates that the vulnerability exists in all releases below the 1.7.1 update, which addresses the token binding and capability checks.

The risk is amplified by the lack of an access control check; any person with a token can abuse the download endpoint. Although no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the severity of data exposure is high. An exploit requires only the possession of a valid token, which could be leaked or guessed, making it feasibly exploitable in many environments where the plugin is exposed to the internet.