The All push notification for WP plugin allows an authenticated administrator or higher to inject arbitrary SQL through the delete_id parameter. By appending malicious statements to the existing query, an attacker can read sensitive data stored in the WordPress database. This injection flaw falls under CWE-89 and can compromise the confidentiality of all information managed by the site.

The vulnerability exists in all versions of the All push notification for WP plugin up to and including 1.5.3. The product is developed by gtlwpdev and distributed for WordPress sites.

The CVSS score is 4.9, indicating a medium severity risk. The EPSS score of less than 1 % suggests that active exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated administrator-level access; an attacker would submit a crafted delete_id value via the plugin’s deletion interface to inject additional SQL clauses. The resulting data exposure could be limited to the administrator’s privileges but could still reveal database contents. The attack vector is inferred to be authentic supplied requests from an administrator, as the description specifies that only users with enough privileges can exploit the flaw.