EUVD-2026-66986
GHSA-v8h5-qhh6-96c7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister subscriber account
-
DeliveryAuthenticate to WordPress
-
ExploitSend crafted request to unprotected plugin endpoint
-
ExecutionBypass missing authorization check
-
ImpactRead or modify push notification data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid WordPress subscriber-level (or higher) account on the target site; completely unauthenticated exploitation is not supported by the CVSS PR:L vector. Open user registration on the WordPress site (Settings > General > 'Anyone can register') lowers the barrier to obtaining such an account to near zero. The plugin must be installed and active. The BuddyPress plugin is implied as a co-dependency by the product name and design intent, though the specific broken endpoints may function independently of BuddyPress being active. Exploitation is limited to endpoints within this specific plugin - no operating system or server-level access is implied. Scope is unchanged (S:U), so lateral movement beyond the WordPress application layer is not a direct consequence of this vulnerability alone. |
| Impact | The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N indicates a network-accessible, low-complexity flaw requiring low privileges (subscriber role) and no user interaction, with limited confidentiality and integrity impact and no availability impact. Real-world risk is moderate: exploitation requires at minimum a subscriber account on the target WordPress installation, which limits mass automated exploitation but is a trivial barrier on sites with open registration. There is no EPSS score provided in available data, no CISA KEV listing, and no public proof-of-concept identified - signals that suggest opportunistic rather than active targeted exploitation at this time. The primary concern is on multi-tenant or community WordPress deployments running BuddyPress where subscriber self-registration is enabled, where the authorization bypass could allow manipulation of push notification settings or subscription data. This is a genuine medium-priority issue for affected deployments rather than a critical emergency. |
| Exploit ScenarioDerived | An attacker registers a free subscriber account on a WordPress site running BuddyPress with open registration enabled. Using their subscriber session cookie, they send a crafted HTTP request to an insufficiently protected plugin endpoint - such as an admin-only AJAX action - bypassing the missing authorization check to read push notification subscriber lists or modify notification settings they should not control. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 27, 2026
Broken access control in the Push Notification for Post and BuddyPress WordPress plugin (version <= 3.20) allows authenticated users with subscriber-level privileges to perform actions restricted to higher-privileged roles, resulting in unauthorized read and write access. Exploitation requires only a valid WordPress subscriber account on the target site, making it relevant wherever the plugin is installed on community-oriented or membership-based WordPress sites running BuddyPress. No public exploit has been identified at time of analysis, and the CVSS score of 5.4 (Medium) reflects limited but real integrity and confidentiality impact without availability consequences.
RemediationAI
Patch availability per vendor or Patchstack advisory should be confirmed at https://patchstack.com/database/wordpress/plugin/push-notification-for-post-and-buddypress/vulnerability/wordpress-push-notification-for-post-and-buddypress-plugin-3-20-broken-access-control-vulnerability - no specific patched version number is confirmed in currently available data, so administrators should check for a plugin update beyond version 3.20 via the WordPress plugin repository. As an interim compensating control, sites that do not require the plugin's functionality should deactivate and remove it immediately. On sites where it is operationally required, disabling open subscriber registration (Settings > General > uncheck 'Anyone can register') reduces the exploitable pool to already-trusted accounts. Additionally, a Web Application Firewall rule blocking unauthorized access to the plugin's AJAX or REST endpoints can serve as a partial mitigation, though endpoint names would need to be identified from plugin source. Note that WAF-based blocking may interfere with legitimate plugin functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the WordPress plugin 'Push Notification for Post and BuddyPress' by developer murali (CPE: cpe:2.3:a:murali:push_notification_for_post_and_buddypress:*:*:*:*:*:*:*:*), designed to send push notifications for post publications and BuddyPress social activity. CWE-862 (Missing Authorization) is the root cause class, meaning one or more plugin endpoints or AJAX actions fail to verify whether the calling user holds the appropriate capability before executing privileged logic. In WordPress plugins, this commonly manifests as unprotected wp-admin AJAX actions or REST API routes that check only for authentication (is_user_logged_in()) rather than capability (current_user_can('manage_options') or similar). Because BuddyPress enables subscriber-level registration on many community sites, the attack surface is broadened wherever open registration is enabled.
Know when Push Notification For Post And Buddypress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
PR:L confirmed by 'subscriber' requirement; network vector applies as WordPress AJAX/REST endpoint; no availability impact from access control bypass alone.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a para
Unauthenticated remote attackers can abuse a missing authorization check (CWE-862) in the WordPress plugin Push Notifica
Exploit-DB