CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Murali Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through <= 2.11.
Explanation of Vulnerability in Simple Terms
Push Notification for Post and BuddyPress versions 2.11 and earlier lack proper authorization checks. An unauthenticated attacker can modify data or disrupt service availability by sending network requests to the plugin without needing valid credentials. Update to a version newer than 2.11 to resolve this issue.
What an attacker can do
Modify plugin data or cause service disruption without authentication.
Potential impact on your site
Unauthorized users can alter notifications or cause the plugin to malfunction, affecting post and BuddyPress notification delivery.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
