CVE-2024-6159
The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Score
- CVSS 3.1 9.8 Critical
- Status
- Analyzed - contact@wpscan.com
- Published
- 2025-05-15
- Last modified
- 2025-05-20
- Weaknesses
- CWE-89
Affected products
- Push Notification For Post And Buddypress (Pnfpb)
- Push Notification For Post And Buddypress (Unknown)
References
- https://wpscan.com/vulnerability/de20ebda-b0bc-489e-a8d3-e9487a2b48e8/
