PT-2026-6022 · WordPress · Push Notification For Wp

0X34Rth + 1 · Publicado 2026-02-04 · Atualizado 2026-02-04 · CVE-2026-0816

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions All push notification for WP versions up to and including 1.5.3

Description The All push notification for WP plugin for WordPress is susceptible to time-based SQL Injection via the delete id parameter. This is due to inadequate escaping of user-supplied input and insufficient preparation of the existing SQL query. Successful exploitation allows authenticated attackers with administrator-level access or higher to inject additional SQL queries into existing queries, potentially enabling the extraction of sensitive information from the database.

Recommendations Versions prior to and including 1.5.3 should be updated to a newer, fixed version when available.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-0816

Produtos afetados

Push Notification For Wp

Referências · 5

• https://plugins.trac.wordpress.org/browser/all-push-notification/trunk/pushnotification-admin/class-pushnotification-admin.php#L95 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-0816 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/all-push-notification/tags/1.5.3/pushnotification-admin/class-pushnotification-admin.php#L95 · Nota
• https://t.me/CVEtracker/43710 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/fc1f36b1-cf28-472c-8a7a-f091ecb48c2d?source=cve · Nota