CVE-2026-3569 affects the Liaison Site Prober WordPress plugin by exposing sensitive audit log information through a REST API endpoint due to a missing authorization check. The permissions_read() callback function returns true unconditionally, allowing unauthenticated attackers to retrieve data such as IP addresses, user IDs, usernames, login/logout events, failed login attempts, and detailed activity logs. This vulnerability impacts all versions up to and including 1.2.1. The CVSS 3.1 score is 5.3, reflecting a medium severity information exposure via a network vector without requiring privileges or user interaction. No patch or official fix has been published yet.

An unauthenticated attacker can access sensitive audit logs containing user and login activity information, potentially aiding further reconnaissance or targeted attacks. The exposure is limited to information disclosure without integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the REST API endpoint if possible, for example by disabling the Liaison Site Prober plugin or limiting access to authenticated users via other WordPress access controls or web server rules.