{"id":"CVE-2026-100514","published":"2026-10-01T15:17:17.660","lastModified":"2026-10-01T20:31:55.537","description":"Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.2 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-rest-api-log/vulnerability/wordpress-rest-api-log-plugin-1-7-2-insecure-direct-object-references-idor-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An unauthenticated IDOR vulnerability allows attackers to access REST API logs without authentication, potentially exposing sensitive operational data. This affects versions 1.7.2 and earlier.","exploitability":"Exploitation is straightforward with no prerequisites, requiring only access to the vulnerable REST API endpoint to enumerate and access logs from other users or systems.","blast_radius":"The impact could be significant as attackers may gain access to sensitive operational logs, configuration details, and potentially system credentials or session information from other users.","remediation":"Upgrade to REST API Log version 1.7.3 or later to remediate the IDOR vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["idor","api","log","rest"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:05:28.825Z"}}