Push Notification BuddyPress CVE-2026-107417

Exploitation requires that a target WordPress site have the Push Notification for Post and BuddyPress plugin installed and active at a version from n/a through 3.23. The flaw is a missing authorization check (CWE-862), so the attacker needs network reachability to the affected plugin endpoint but, per the AV:N/AC:L/PR:N/UI:N vector, no authentication, no special configuration, and no user interaction. The input does not name the specific vulnerable feature, endpoint, or parameter - Patchstack's generic 'incorrectly configured access control' wording does not isolate a single setting - so the precise trigger should be confirmed against the vendor/Patchstack advisory. The primary limiting factor is deployment: only sites running this specific, relatively niche plugin are exposed, and impact is confined to low-level data read/modification rather than full site takeover.

This is a moderate-severity Missing Authorization flaw (CWE-862) in a WordPress plugin, with a vendor-supplied CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N scoring 6.5. The vector indicates network-reachable, low-complexity, unauthenticated exploitation (PR:N) with no user interaction, but impact is bounded to LOW confidentiality and LOW integrity with no availability impact - consistent with an attacker reaching functionality or data that should have been access-controlled, rather than full compromise. There is no CISA KEV listing and no public exploit code identified in the provided data, so exploitation status is 'no public exploit identified at time of analysis'. No EPSS score or SSVC decision data was provided, so probability-of-exploitation and automatability cannot be quantified from this input. Net assessment: a legitimate issue worth patching on exposed sites given unauthenticated network access, but not an emergency - the limited CVSS impact, absence of KEV/POC signals, and the plugin's likely modest deployment footprint place it in routine-patch priority rather than drop-everything territory. The signals are internally consistent (no CVSS-vs-description conflict), but the analysis rests almost entirely on a single source (Patchstack).

An unauthenticated remote attacker sends a crafted HTTP request to a plugin endpoint that lacks a proper capability/authorization check, reaching functionality intended for privileged users. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network access to a site running the vulnerable plugin and no credentials or victim interaction. No public proof-of-concept was identified in the provided data, limiting turnkey mass exploitation.