The vulnerability in Gravitec.net – Web Push Notifications for WordPress manifests as a missing authorization check that allows attackers to bypass intended role restrictions. This broken access control can lead to unauthorized modification of push notification data, potentially exposing confidential information or disrupting content delivery. The weakness is identified as CWE‑862, representing insufficient enforcement of authorization boundaries, which compromises the integrity of the plugin’s operations.

The affected product is the Gravitec.net – Web Push Notifications WordPress plugin, versions from the initial release through 2.9.17. Any WordPress site running these versions is within the attack surface.

The CVSS score of 4.3 indicates a moderate impact, while the EPSS score of less than 1% points to a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been documented. Based on the description, it is inferred that an attacker could exploit this flaw via unauthenticated or low‑privilege HTTP requests to the plugin’s endpoints, provided they can reach the WordPress installation. While a full system compromise is unlikely, unauthorized changes to push notification registrations or data are possible.