A missing authorization flaw in App Cheap’s Push notification for Mobile and Web app plugin lets attackers exploit incorrectly configured access control security levels. The vulnerability allows an attacker to perform actions that should be restricted, potentially granting unauthorized control over push notification configuration and delivery. The weakness is a classic Missing Authorization issue, which can expose sensitive operations if left unpatched.

The affected product is App Cheap’s Push notification for Mobile and Web app plugin, versions from the earliest release through version 2.0.3. All instances of the plugin within that version range are impacted.

The CVSS score of 6.5 categorizes the flaw as moderately severe. The EPSS score of less than 1% indicates a low probability of exploitation at the time of assessment, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, through web requests to the plugin’s endpoints, allowing an attacker to exploit the missing authorization once the plugin is installed and accessed, even by users lacking proper privileges. Given the nature of the flaw—incorrectly configured access controls—any authenticated or possibly unauthenticated user could gain elevated capabilities.