The Liaison Site Prober plugin for WordPress exposes a REST API endpoint at /wp-json/site-prober/v1/logs that, due to a permission callback that always returns true, allows any visitor to retrieve audit logs without authentication. The exposed logs contain IP addresses, user identifiers, usernames, login and logout events, failed login attempts, and detailed activity descriptions, leading to significant confidentiality loss. The flaw is a classic missing authorization check, mapped to CWE-862.

All installations of the Liaison Site Prober plugin for WordPress with a version equal to or lower than 1.2.1 are vulnerable, as the issue exists in every release up to that point. Sites running these versions, regardless of active or inactive status of the plugin, could expose sensitive audit data.

The CVSS score of 5.3 reflects moderate severity, while the EPSS score of less than 1% indicates a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, yet its simple HTTP GET access via a publicly exposed REST endpoint means attackers can easily trigger it without further credentials. The risk is primarily the accidental or intentional disclosure of audit information to any unauthenticated visitor.