{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3569", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-04T20:51:43.677Z", "datePublished": "2026-04-24T07:45:08.536Z", "dateUpdated": "2026-04-24T12:02:32.146Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-24T07:45:08.536Z"}, "affected": [{"vendor": "liaison", "product": "Liaison Site Prober", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Liaison Site Prober plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 1.2.1 via the /wp-json/site-prober/v1/logs REST API endpoint. The permissions_read() permission callback unconditionally returns true (via __return_true()) instead of checking for appropriate capabilities. This makes it possible for unauthenticated attackers to retrieve sensitive audit log data including IP addresses, user IDs, usernames, login/logout events, failed login attempts, and detailed activity descriptions."}], "title": "Liaison Site Prober <= 1.2.1 - Missing Authorization to Unauthenticated Information Exposure in '/logs' REST API Endpoint", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eda5addb-40e2-4187-b803-34500b36be0a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/liaison-site-prober/trunk/includes/class-liaison-rest-controller.php#L50"}, {"url": "https://plugins.trac.wordpress.org/browser/liaison-site-prober/tags/1.2.1/includes/class-liaison-rest-controller.php#L50"}, {"url": "https://plugins.trac.wordpress.org/browser/liaison-site-prober/trunk/includes/class-liaison-rest-controller.php#L90"}, {"url": "https://plugins.trac.wordpress.org/browser/liaison-site-prober/tags/1.2.1/includes/class-liaison-rest-controller.php#L90"}, {"url": "https://plugins.trac.wordpress.org/browser/liaison-site-prober/trunk/includes/class-liaison-rest-controller.php#L19"}, {"url": "https://plugins.trac.wordpress.org/browser/liaison-site-prober/tags/1.2.1/includes/class-liaison-rest-controller.php#L19"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3481019%40liaison-site-prober&new=3481019%40liaison-site-prober&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Itthidej Aramsri"}], "timeline": [{"time": "2026-04-23T19:17:51.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-24T12:02:24.939927Z", "id": "CVE-2026-3569", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-24T12:02:32.146Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3569", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-24T12:02:24.939927Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-24T12:02:27.229Z"}}], "cna": {"title": "Liaison Site Prober <= 1.2.1 - Missing Authorization to Unauthenticated Information Exposure in '/logs' REST API Endpoint", "credits": [{"lang": "en", "type": "finder", "value": "Itthidej Aramsri"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "liaison", "product": "Liaison Site Prober", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-04-23T19:17:51.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eda5addb-40e2-4187-b803-34500b36be0a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/liaison-site-prober/trunk/includes/class-liaison-rest-controller.php#L50"}, {"url": "https://plugins.trac.wordpress.org/browser/liaison-site-prober/tags/1.2.1/includes/class-liaison-rest-controller.php#L50"}, {"url": "https://plugins.trac.wordpress.org/browser/liaison-site-prober/trunk/includes/class-liaison-rest-controller.php#L90"}, {"url": "https://plugins.trac.wordpress.org/browser/liaison-site-prober/tags/1.2.1/includes/class-liaison-rest-controller.php#L90"}, {"url": "https://plugins.trac.wordpress.org/browser/liaison-site-prober/trunk/includes/class-liaison-rest-controller.php#L19"}, {"url": "https://plugins.trac.wordpress.org/browser/liaison-site-prober/tags/1.2.1/includes/class-liaison-rest-controller.php#L19"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3481019%40liaison-site-prober&new=3481019%40liaison-site-prober&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Liaison Site Prober plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 1.2.1 via the /wp-json/site-prober/v1/logs REST API endpoint. The permissions_read() permission callback unconditionally returns true (via __return_true()) instead of checking for appropriate capabilities. This makes it possible for unauthenticated attackers to retrieve sensitive audit log data including IP addresses, user IDs, usernames, login/logout events, failed login attempts, and detailed activity descriptions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-24T07:45:08.536Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3569", "state": "PUBLISHED", "dateUpdated": "2026-04-24T12:02:32.146Z", "dateReserved": "2026-03-04T20:51:43.677Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-24T07:45:08.536Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Liaison Site Prober plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 1.2.1 via the /wp-json/site-prober/v1/logs REST API endpoint. The permissions_read() permission callback unconditionally returns true (via __return_true()) instead of checking for appropriate capabilities. This makes it possible for unauthenticated attackers to retrieve sensitive audit log data including IP addresses, user IDs, usernames, login/logout events, failed login attempts, and detailed activity descriptions."}], "id": "CVE-2026-3569", "lastModified": "2026-04-24T14:38:26.740", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-24T08:16:30.217", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/liaison-site-prober/tags/1.2.1/includes/class-liaison-rest-controller.php#L19"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/liaison-site-prober/tags/1.2.1/includes/class-liaison-rest-controller.php#L50"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/liaison-site-prober/tags/1.2.1/includes/class-liaison-rest-controller.php#L90"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/liaison-site-prober/trunk/includes/class-liaison-rest-controller.php#L19"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/liaison-site-prober/trunk/includes/class-liaison-rest-controller.php#L50"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/liaison-site-prober/trunk/includes/class-liaison-rest-controller.php#L90"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3481019%40liaison-site-prober&new=3481019%40liaison-site-prober&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eda5addb-40e2-4187-b803-34500b36be0a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.2.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Liaison Site Prober", "source": "cna", "vendor": "liaison"}, "product": "liaison_site_prober", "vendor": "liaison"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-28T14:23:13.378222+00:00", "value": {"mitigation_remediation": ["Update the Liaison Site Prober plugin to the latest released version that removes the unrestricted /logs endpoint or corrects the permission check.", "If an upgrade is not possible, modify or delete the route that serves /wp-json/site-prober/v1/logs, or change its permission callback to require a higher capability such as manage_options.", "Deploy a web application firewall rule or use the WordPress mod_security integration to block unauthenticated GET requests to /wp-json/site-prober/v1/logs.", "Monitor the site for unusual activity that may indicate exploitation of this endpoint and review audit logs to detect any data leakage."], "summary": {"action": "Immediate Patch", "impact": "Unrestricted disclosure of audit log data"}, "threat_synthesis": {"affected_systems": "All installations of the Liaison Site Prober plugin for WordPress with a version equal to or lower than 1.2.1 are vulnerable, as the issue exists in every release up to that point. Sites running these versions, regardless of active or inactive status of the plugin, could expose sensitive audit data.", "description_and_impact": "The Liaison Site Prober plugin for WordPress exposes a REST API endpoint at /wp-json/site-prober/v1/logs that, due to a permission callback that always returns true, allows any visitor to retrieve audit logs without authentication. The exposed logs contain IP addresses, user identifiers, usernames, login and logout events, failed login attempts, and detailed activity descriptions, leading to significant confidentiality loss. The flaw is a classic missing authorization check, mapped to CWE-862.", "risk_and_exploitability": "The CVSS score of 5.3 reflects moderate severity, while the EPSS score of less than 1% indicates a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, yet its simple HTTP GET access via a publicly exposed REST endpoint means attackers can easily trigger it without further credentials. The risk is primarily the accidental or intentional disclosure of audit information to any unauthenticated visitor."}}}}, "created": "2026-04-28T09:18:03.407516+00:00", "updated": "2026-04-28T14:30:33.758299+00:00", "vendors": ["liaison", "liaison$PRODUCT$liaison_site_prober", "wordpress", "wordpress$PRODUCT$wordpress"]}