PushEngage WordPress Plugin EUVD-2026-37626

Exploitation requires (1) a WordPress site with the PushEngage - Web Push Notifications, eCommerce Automation & Chat Widget plugin installed and active at version 4.2.3 or earlier, (2) network reachability to the site's admin-ajax or REST API surface, and (3) an authenticated session at a low privilege level (PR:L per the CVSS vector - typically Subscriber or Contributor, achievable on sites that allow open user registration). Exploitation is limited by the need for any authenticated account, so sites that disable public registration and tightly control low-privileged accounts materially reduce risk; no user interaction by a victim is required (UI:N).

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) shows network reachability, low complexity, low privileges required, no user interaction, and - notably - a scope change with low impact across all three CIA properties, yielding a 7.4 score driven largely by S:C rather than by severe individual impacts. There is no EPSS score, no CISA KEV listing, and no POC referenced in the supplied intelligence, so real-world exploitation pressure appears low at this time despite the elevated CVSS. The I:L and A:L ratings are worth scrutinizing because a CWE-201 disclosure bug usually maps to C:L only; the vendor's choice of I:L/A:L is not explained in the Patchstack reference summary and should be verified against the full Patchstack advisory before treating this as more than a confidentiality issue.

An attacker who has registered or obtained any low-privileged WordPress account (e.g., Subscriber or Contributor) on a site running PushEngage <= 4.2.3 authenticates and issues a crafted request to a PushEngage endpoint that returns subscriber data. The response leaks subscriber records belonging to the site, allowing the attacker to harvest a list of push-notification subscribers for phishing, spam, or follow-on targeting. No public exploit identified at time of analysis, but the low complexity and authenticated-only barrier make this trivially reproducible once the vulnerable endpoint is known.