Push Notification For Post And Buddypress
Monthly
Unauthenticated remote attackers can abuse a missing authorization check (CWE-862) in the WordPress plugin Push Notification for Post and BuddyPress to reach plugin functionality that should be access-controlled, affecting all releases from the initial version through 3.23. The assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N scores 6.5, meaning any exposed site running this niche plugin can be probed by network attackers with no credentials, no user interaction, and no special configuration, but impact stays at low-level data disclosure and modification rather than full site compromise. No public exploit identified at time of analysis; the main exposure limiter is deployment, since only sites with the plugin installed and active are reachable.
Broken access control in the Push Notification for Post and BuddyPress WordPress plugin (version <= 3.20) allows authenticated users with subscriber-level privileges to perform actions restricted to higher-privileged roles, resulting in unauthorized read and write access. Exploitation requires only a valid WordPress subscriber account on the target site, making it relevant wherever the plugin is installed on community-oriented or membership-based WordPress sites running BuddyPress. No public exploit has been identified at time of analysis, and the CVSS score of 5.4 (Medium) reflects limited but real integrity and confidentiality impact without availability consequences.
The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated remote attackers can abuse a missing authorization check (CWE-862) in the WordPress plugin Push Notification for Post and BuddyPress to reach plugin functionality that should be access-controlled, affecting all releases from the initial version through 3.23. The assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N scores 6.5, meaning any exposed site running this niche plugin can be probed by network attackers with no credentials, no user interaction, and no special configuration, but impact stays at low-level data disclosure and modification rather than full site compromise. No public exploit identified at time of analysis; the main exposure limiter is deployment, since only sites with the plugin installed and active are reachable.
Broken access control in the Push Notification for Post and BuddyPress WordPress plugin (version <= 3.20) allows authenticated users with subscriber-level privileges to perform actions restricted to higher-privileged roles, resulting in unauthorized read and write access. Exploitation requires only a valid WordPress subscriber account on the target site, making it relevant wherever the plugin is installed on community-oriented or membership-based WordPress sites running BuddyPress. No public exploit has been identified at time of analysis, and the CVSS score of 5.4 (Medium) reflects limited but real integrity and confidentiality impact without availability consequences.
The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.