CVE-2026-3569: 
WordPress vulnerability analysis and mitigation

CVE-2026-3569 is an information exposure vulnerability in the Liaison Site Prober plugin for WordPress, classified as Missing Authorization (CWE-862). All versions up to and including 1.2.1 are affected. The flaw allows unauthenticated attackers to access sensitive audit log data via an unprotected REST API endpoint. It was published on April 24, 2026, with a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Wordfence).

The root cause is a missing authorization check (CWE-862) in the permissions_read() permission callback within class-liaison-rest-controller.php. Instead of verifying that the requesting user holds appropriate WordPress capabilities, the callback unconditionally returns true via PHP's built-in __return_true() function, effectively making the /wp-json/site-prober/v1/logs REST API endpoint publicly accessible without any authentication. The vulnerable code is visible at lines 19, 50, and 90 of the plugin's REST controller class (GitHub Advisory, WordPress Trac).

Unauthenticated attackers can retrieve sensitive audit log data from any WordPress site running the affected plugin, including IP addresses, user IDs, usernames, login/logout events, failed login attempts, and detailed activity descriptions. This information exposure primarily affects confidentiality with no direct integrity or availability impact. The exposed data can enable targeted reconnaissance, valid account enumeration, and planning of credential-stuffing or brute-force attacks against the affected WordPress installations (GitHub Advisory, Wordfence).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires no authentication, no user interaction, and no special privileges, making it trivially exploitable by any network-accessible attacker against vulnerable installations. The EPSS score is approximately 0.026% (0.000260), indicating a low current probability of exploitation within the next 30 days. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Reconnaissance: Identify WordPress sites running the Liaison Site Prober plugin (versions ≤ 1.2.1) using web crawlers, Shodan, or by checking publicly accessible plugin directories (e.g., /wp-content/plugins/liaison-site-prober/).
2. Confirm vulnerability: Verify the plugin is active by attempting to access the REST API endpoint directly — a successful response indicates the vulnerable version is installed.
3. Send unauthenticated request: Issue an HTTP GET request to the target site's REST API endpoint without any authentication headers:

   GET /wp-json/site-prober/v1/logs HTTP/1.1
   Host: target-wordpress-site.com

4. Harvest audit log data: Parse the JSON response to extract IP addresses, user IDs, usernames, login/logout timestamps, failed login attempts, and activity descriptions for use in further targeted attacks (GitHub Advisory, Wordfence).

• Network: Unauthenticated HTTP GET requests to /wp-json/site-prober/v1/logs from external or unexpected IP addresses; repeated or automated requests to this endpoint in short time windows.
• Logs: WordPress access logs showing GET /wp-json/site-prober/v1/logs requests returning HTTP 200 responses from unauthenticated clients (no Authorization header or session cookie); high-frequency requests from a single IP suggesting automated scraping.
• Application: Absence of authentication context in REST API request logs for the site-prober/v1/logs route (GitHub Advisory, Wordfence).

Site administrators should immediately audit WordPress installations for the Liaison Site Prober plugin at versions 1.2.1 or earlier and disable or remove the plugin if it is not actively required. A patch was noted as available via the WordPress plugin repository changeset (revision 3481019), so updating to the latest version from the WordPress plugin repository is the recommended remediation (WordPress Trac). As a temporary workaround, implement web application firewall (WAF) rules to restrict access to the /wp-json/site-prober/v1/logs endpoint to authenticated or trusted IP ranges only. Monitor REST API access logs for suspicious unauthenticated requests to this endpoint (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory on April 24, 2026 (Wordfence). No significant broader media coverage or notable community commentary beyond standard vulnerability database aggregation has been identified for this moderate-severity issue.