PT-2026-34864 · WordPress · Liaison Site Prober

Itthidej Aramsri · Published 2026-04-24 · Updated 2026-04-25 · CVE-2026-3569

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Liaison Site Prober versions prior to 1.2.2

Description The plugin is subject to information exposure through the '/wp-json/site-prober/v1/logs' REST API endpoint. The permissions read() permission callback uses return true(), which unconditionally grants access instead of verifying user capabilities. This allows unauthenticated attackers to access sensitive audit log data, including IP addresses, user IDs, usernames, login/logout events, failed login attempts, and activity descriptions.

Recommendations Update the plugin to a version later than 1.2.1. As a temporary workaround, restrict access to the '/wp-json/site-prober/v1/logs' endpoint to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-3569

Affected Products

Liaison Site Prober

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-3569 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/eda5addb-40e2-4187-b803-34500b36be0a?source=cve · Note
• https://plugins.trac.wordpress.org/browser/liaison-site-prober/tags/1.2.1/includes/class-liaison-rest-controller.php#L90 · Note
• https://plugins.trac.wordpress.org/browser/liaison-site-prober/tags/1.2.1/includes/class-liaison-rest-controller.php#L50 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3481019%40liaison-site-prober&new=3481019%40liaison-site-prober&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/liaison-site-prober/trunk/includes/class-liaison-rest-controller.php#L90 · Note
• https://twitter.com/CVEnew/status/2048099303613202472 · Twitter Post
• https://plugins.trac.wordpress.org/browser/liaison-site-prober/trunk/includes/class-liaison-rest-controller.php#L19 · Note
• https://plugins.trac.wordpress.org/browser/liaison-site-prober/trunk/includes/class-liaison-rest-controller.php#L50 · Note
• https://plugins.trac.wordpress.org/browser/liaison-site-prober/tags/1.2.1/includes/class-liaison-rest-controller.php#L19 · Note