Cross-Site Request Forgery in WP Firebase Push Notification Plugin by WordPress
CVE-2025-5924

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
WP Firebase Push Notification
Vendor
CVE Published:
4 July 2025

What is CVE-2025-5924?

The WP Firebase Push Notification plugin for WordPress has a vulnerability that allows Cross-Site Request Forgery (CSRF), resulting from improper nonce validation in the wfpn_brodcast_notification_message() function. This vulnerability allows unauthenticated attackers to issue broadcast notifications via forged requests, provided they can deceive an administrator into triggering the exploit, such as by clicking a malicious link. All versions of the plugin up to and including version 1.2.0 are affected, making it crucial for users to apply necessary updates and implement additional security measures.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

WP Firebase Push Notification * <= 1.2.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-push-notifi...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.