Cross‑Site Request Forgery allows an attacker to trigger a Blind SQL Injection in the All push notification for WP plugin. The flaw enables arbitrary manipulation or exfiltration of the WordPress database, potentially revealing sensitive user information or corrupting site data. The vulnerability’s use of unchecked input is catalogued as CWE‑352.

WordPress sites using the gtlwpdev All push notification for WP plugin with versions up to and including 1.5.3 are affected. No other platforms or products are listed.

The reported CVSS score of 8.2 classifies the issue as high severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not yet in CISA’s KEV catalog. Nevertheless, the CSRF nature means an attacker can force a victim’s browser to initiate the injection, so any user with site access can be the target. If the plugin’s CSRF protection is bypassed, the attacker can craft a request that manipulates database contents or reads data. The combination of high impact and low known exploitation probability calls for proactive mitigation.