CVE-2026-107417
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Push Notification for Post and BuddyPress plugin (Muralidharan Ramasamy) in versions up to 3.23 contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Risk Assessment
An attacker may send unauthorized notifications or access administrative functions, potentially leading to spam or phishing distribution.
Recommendation
Update the Push Notification for Post and BuddyPress plugin to a version later than 3.23 once a fix is available, and verify notification sending permissions.
Other vulnerabilities in Push Notification for Post and BuddyPress
Original NVD description (English source)
Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through 3.23.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS