The vulnerability allows an attacker to retrieve confidential information without authentication by accessing the WordPress REST API Log plugin's logging endpoint. Since the plugin records request data, an unauthenticated user can read sensitive logs that include request parameters, headers, and potentially user credentials. This exposure can lead to information disclosure that compromises confidentiality and aids further attacks.

The issue affects WordPress sites using the REST API Log plugin version 1.7.1 or earlier, developed by Pete Nelson. The vulnerability has not been reported in newer releases; any installation of 1.7.1 or lower is at risk.

The CVSS score of 7.5 classifies the flaw as high severity, while the EPSS score is not available, indicating no current exploitation probability data. The flaw is unauthenticated and the plugin is widely deployed, so the risk remains significant. The relevant attack vector is an unauthenticated REST API call to the plugin's logging endpoint. The vulnerability is not listed in CISA KEV, but the lack of a formal mitigation does not reduce its potential impact.