CVE-2026-66443 HIGH

CVE-2026-66443: WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability

Vendor Pete Nelson
Product REST API Log
Weakness CWE-201
Published August 13, 2026
Last update August 13, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions.

Explanation of Vulnerability in Simple Terms

02Summary

REST API Log versions up to 1.7.1 expose sensitive information in outbound data transmissions. An unauthenticated attacker on the network can intercept API responses to read confidential details without modifying data or disrupting service. The vulnerability requires no user interaction and affects all installations of the affected version range.

What an attacker can do

03Attacker Capabilities

Read sensitive information from REST API responses by intercepting network traffic.

Potential impact on your site

04Site Impact

Confidential data (API keys, tokens, user details) may be exposed to network eavesdroppers.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 13, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-42667 WordPress Bookly plugin <= 27.4 - Sensitive Data Exposure vulnerability CVE-2026-24992 WordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.2 - Sensitive Data Exposure vulnerability CVE-2026-66696 WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.8 - Sensitive Data Exposure vulnerability CVE-2026-27406 WordPress My Tickets plugin <= 2.1.0 - Sensitive Data Exposure vulnerability CVE-2026-66685 WordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability