The WP Firebase Push Notification WordPress plugin contains a CSRF flaw in all releases up to and including version 1.2.0. Missing or incorrect nonce validation on the broadcast function permits an attacker to forge a request that, if a site administrator is tricked into clicking a link, will cause the site to send a notification to all users. The primary impact is the ability to distribute spam or phishing messages without the administrator’s consent, which undermines the confidentiality and trust of the notification system. This weakness is classified as CWE-352.

All installations of the WP Firebase Push Notification plugin from skywaveinfo that use version 1.2.0 or earlier are affected. The plugin should be upgraded to a later release where nonce handling has been corrected.

The CVSS score of 4.3 reflects a moderate severity. The EPSS score of less than 1% indicates a low probability that this vulnerability will be actively exploited at this time, and it is not listed in CISA’s KEV catalog. The attack vector is most likely limited to websites that allow an administrator to follow a malicious link, making the exploitation scenario plausible but not highly probable. Nonetheless, the potential damage from unsolicited broadcast messages warrants prompt attention.