What is the CVSS score of CVE-2026-3569?

CVE-2026-3569 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Liaison Site Prober CVE-2026-3569

EUVD-2026-25406 MEDIUM

Missing Authorization (CWE-862)

2026-04-24 Wordfence

GHSA-x2pj-x7hv-qm35

Information Disclosure WordPress Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 24, 2026 - 08:30 vuln.today

EUVD ID Assigned

Apr 24, 2026 - 08:00 euvd

EUVD-2026-25406

Analysis Generated

Apr 24, 2026 - 08:00 vuln.today

CVE Published

Apr 24, 2026 - 07:45 nvd

MEDIUM 5.3

DescriptionCVE.org

The Liaison Site Prober plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 1.2.1 via the /wp-json/site-prober/v1/logs REST API endpoint. The permissions_read() permission callback unconditionally returns true (via __return_true()) instead of checking for appropriate capabilities. This makes it possible for unauthenticated attackers to retrieve sensitive audit log data including IP addresses, user IDs, usernames, login/logout events, failed login attempts, and detailed activity descriptions.

AnalysisAI

Liaison Site Prober plugin for WordPress allows unauthenticated attackers to retrieve sensitive audit log data including IP addresses, user IDs, usernames, and login events through an improperly secured REST API endpoint (/wp-json/site-prober/v1/logs) in all versions up to 1.2.1. The vulnerability stems from a permission callback that unconditionally returns true without validating user capabilities, enabling information disclosure with network-level access and no authentication required. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The Liaison Site Prober WordPress plugin exposes a REST API endpoint at /wp-json/site-prober/v1/logs that provides access to audit logging data. The vulnerability is rooted in CWE-862 (Missing Authorization), specifically in the permissions_read() callback function defined in class-liaison-rest-controller.php. Instead of implementing capability checks using WordPress's standard has_cap() or current_user_can() functions, the callback uses PHP's __return_true() helper function, which bypasses all permission validation. This allows any HTTP request to the endpoint-whether authenticated or not-to retrieve the full audit log. The affected product is identified by CPE cpe:2.3:a:liaison:liaison_site_prober:*:*:*:*:*:*:*:*, indicating all versions are in scope; however, versions up to and including 1.2.1 are explicitly documented as vulnerable.

RemediationAI

Update the Liaison Site Prober plugin to a patched version released after 1.2.1 as soon as available from the WordPress plugin repository or the vendor's website. Pending availability of a patched version, apply the following compensating controls: disable the /wp-json/site-prober/v1/logs REST API endpoint by adding a filter to the WordPress functions.php file or using a code snippets plugin, or implement Web Application Firewall (WAF) rules to block requests to /wp-json/site-prober endpoints from unauthenticated sources, noting this may break legitimate API consumers and requires testing in a staging environment first. Additionally, restrict REST API access to authenticated users only via WordPress security plugins (e.g., Wordfence, Sucuri) or disable the JSON REST API entirely if not required by other plugins. The source code repository (https://plugins.trac.wordpress.org/browser/liaison-site-prober/) shows the fix should involve replacing __return_true() with a proper capability check such as current_user_can('manage_options') in the permissions_read() callback. Monitor the plugin's update status at https://plugins.wordpress.org/plugins/liaison-site-prober/ for an official patch release.