CVE-2026-81279: WordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability
Published Aug 27, 2026
·Updated
Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.
Affected Software
1 affected component
WordPress Push Notification for Post and BuddyPress<=3.20
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Push Notification for Post and BuddyPressto a version that resolves this vulnerability.Fixed in 3.21
Event History
Aug 27, 2026
CVE Published
via MITRE·08:59 AM
Data Sourced
via MITRE·08:59 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
An attacker needs an existing low-privileged account. The vulnerability is remotely exploitable and does not require user interaction.
2
What is the expected impact of successful exploitation?
Successful exploitation may result in limited unauthorized disclosure and modification of information. No availability impact is indicated.
3
Which plugin versions are affected?
Push Notification for Post and BuddyPress versions 3.20 and earlier are affected.