CVE-2026-3569 is a missing authorization vulnerability (CWE-862) in the Liaison Site Prober WordPress plugin affecting all versions up to and including 1.2.1. The issue is in the /wp-json/site-prober/v1/logs REST API endpoint, where the permissions_read() callback unconditionally returns true, allowing unauthenticated users to retrieve sensitive audit logs. These logs contain IP addresses, user IDs, usernames, login/logout events, failed login attempts, and detailed activity descriptions. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity), with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or vendor advisory is currently available, and no exploits are known in the wild.

An unauthenticated attacker can access sensitive audit log data from the Liaison Site Prober plugin, potentially exposing IP addresses, user identifiers, login events, and other detailed activity information. This information exposure could aid attackers in reconnaissance or further attacks but does not directly impact integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the Liaison Site Prober plugin or restricting access to the /wp-json/site-prober/v1/logs endpoint via web server or firewall rules to prevent unauthorized access.