Missing Authorization in the WordPress Push Notification for Post and BuddyPress plugin allows attackers to bypass correctly configured access control and gain unauthorized permission to send push notifications. This can be used to distribute malicious or spam notifications to unsuspecting users, thereby undermining the integrity and trust of the site and potentially leading to phishing or credential theft. The vulnerability does not grant execution of arbitrary code, but it does provide an attacker with the ability to manipulate the plugin’s core functionality.

Vulnerable installations are WordPress sites running the Push Notification for Post and BuddyPress plugin by Muralidharan Ramasamy, with versions 3.23 or earlier. The affected version range is from the earliest release up to and including 3.23. No other vendors or products are affected according to the CNA.

The CVSS score of 6.5 indicates a moderate overall risk, with the vulnerability being remotely exploitable over the web without the need for elevated privileges. The EPSS score of 0.219% suggests a very low probability that the vulnerability will be targeted by attackers, and the vulnerability is not listed in the CISA KEV catalog, implying no known active exploits. Nonetheless, an attacker who can identify a vulnerable site can directly exploit the broken access control by sending crafted HTTP requests to the plugin’s endpoints, potentially transmitting unauthorized push notifications. Because the flaw operates solely at the authorization level, successful exploitation requires only access to the web interface; no advanced prerequisites are noted in the advisory.