CVE-2026-107417: WordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken Access Control vulnerability
Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through 3.23.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/push-notification-for-post-and-buddypressto a version that resolves this vulnerability.Fixed in 3.24
Event History
Frequently Asked Questions
Does an attacker need an account or user interaction to exploit this issue?
No. The CVSS vector indicates network-based exploitation with no required privileges and no user interaction.
What is the expected impact if exploitation succeeds?
The reported impact is low confidentiality and low integrity impact. No availability impact is indicated.
Which plugin versions should be considered affected?
The issue affects Push Notification for Post and BuddyPress versions through 3.23. A minimum affected version is not specified.