CVE-2026-81279 MEDIUM

CVE-2026-81279: WordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability

Vendor Murali
Product Push Notification for Post and BuddyPress
Weakness CWE-862 · Missing authorization
Published August 27, 2026
Last update August 27, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.

Explanation of Vulnerability in Simple Terms

02Summary

The Push Notification for Post and BuddyPress plugin for WordPress does not properly check user permissions before allowing access to certain functions. A logged-in user with low privileges can read or modify data they should not have access to. Update to a version newer than 3.20.

What an attacker can do

03Attacker Capabilities

A low-privilege logged-in user can read or modify data without proper authorization.

Potential impact on your site

04Site Impact

Unauthorized users may access or alter notification settings, post data, or BuddyPress information.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege account on the site (e.g., subscriber or contributor role).

Key dates

06Disclosure timeline

August 27, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-17153 AI Agent by SiteGround <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint CVE-2026-11801 WPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST Endpoint CVE-2026-66431 WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerability CVE-2026-66660 WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability CVE-2026-66595 WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability