CSRF Vulnerability in All Push Notification for WP by gtlwpdev
CVE-2025-32547

8.2HIGH

Key Information:

Vendor

WordPress
Status
All Push Notification For WP
Vendor
CVE Published:
9 April 2025

What is CVE-2025-32547?

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the All Push Notification for WP plugin developed by gtlwpdev. This vulnerability allows attackers to exploit the application's interaction with the backend, potentially leading to a blind SQL injection attack. The affected versions range from n/a up to 1.5.3, posing a significant risk to sites utilizing this plugin, allowing unauthorized actions and data manipulation by malicious entities.

Affected Version(s)

All push notification for WP <= 1.5.3

References

https://patchstack.com/database/wordpress/plugin/all-push...
vdb-entry

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro S Alcântara (Kinorth) (Patchstack Alliance)
.
The Cyber Security Vulnerability Database.