What is the CVSS score of EUVD-2026-37626?

EUVD-2026-37626 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of PushEngage WordPress Plugin are affected by EUVD-2026-37626?

The PushEngage WordPress plugin 'Web Push Notifications, eCommerce Automation & Chat Widget' (versions ≤4.2.3) contains a sensitive data exposure vulnerability (CWE-201) that allows low-privileged…

How to fix or mitigate EUVD-2026-37626?

Within 24 hours: disable or deactivate the PushEngage plugin on all affected WordPress installations and audit recent access logs for unauthorized subscriber data retrieval by low-privileged accounts. Within 7 days: monitor Patchstack and official WordPress plugin repository for vendor patch release; document all installations and scope of exposed subscriber data. Within 30 days: upgrade to vendor-released patched version once available and implement WordPress role-based access controls restricting plugin to administrator accounts only.

PushEngage WordPress Plugin EUVD-2026-37626

| CVE-2026-52698 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-06-17 Patchstack

WordPress Information Disclosure Wordpress Plugin Pushengage Web Push Notifications Ecommerce Automation Amp Chat Widget Syed Balkhi

7.4

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.4 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

vuln.today AI

4.3 MEDIUM

Authenticated low-privileged WordPress user reads subscriber data over the network; CWE-201 is a confidentiality-only disclosure, so I:N/A:N and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:01 vuln.today

DescriptionCVE.org

Subscriber Sensitive Data Exposure in PushEngage - Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2.3 versions.

AnalysisAI

Sensitive data exposure in the PushEngage WordPress plugin (versions <= 4.2.3) allows authenticated low-privileged users to access subscriber information that should remain protected. The flaw, reported by Patchstack and tracked as CWE-201 (Insertion of Sensitive Information Into Sent Data), affects WordPress sites running the Web Push Notifications, eCommerce Automation & Chat Widget plugin and carries a CVSS 3.1 score of 7.4 with a scope change. No public exploit identified at time of analysis.

Technical ContextAI

PushEngage is a WordPress plugin (CPE: syed_balkhi:pushengage) used by site owners to send web push notifications, run eCommerce automations, and operate a chat widget. The underlying weakness is CWE-201 (Insertion of Sensitive Information Into Sent Data), a class of bug where an application includes sensitive data - here, subscriber records - in a response or output that is accessible to actors who should not see it. In WordPress plugin contexts this typically manifests as an AJAX action, REST endpoint, or admin-ajax handler that fails to enforce capability checks proportional to the sensitivity of the data being returned, leaking subscriber identifiers, endpoints, or contact data across the user/role boundary.

RemediationAI

Patch available per vendor advisory - upgrade the PushEngage plugin to a version newer than 4.2.3 as published on the WordPress.org plugin repository, consulting the Patchstack record at https://patchstack.com/database/wordpress/plugin/pushengage/vulnerability/wordpress-pushengage-web-push-notifications-ecommerce-automation-chat-widget-plugin-4-2-3-sensitive-data-exposure-vulnerability for the exact fixed release. If immediate patching is not possible, deactivate the PushEngage plugin (which will stop push notifications and the chat widget until restored), or restrict access to wp-admin and the WordPress REST/AJAX surface to trusted IPs via a web application firewall or .htaccess rule - accepting that this blocks legitimate low-privileged contributors and subscribers from any plugin functionality they were entitled to. As an interim hardening step, audit which roles can authenticate to the site and remove any low-privileged accounts that are not strictly required, since the flaw requires PR:L access.