CVE-2025-23771: WordPress Push Notification Auth Bypass

CVE-2025-23771 Overview

CVE-2025-23771 is a Missing Authorization vulnerability [CWE-862] in the Murali Push Notification for Post and BuddyPress WordPress plugin. The flaw affects all plugin versions from initial release through 2.11. Unauthenticated attackers can exploit incorrectly configured access control checks to modify plugin settings over the network. The vulnerability requires no user interaction and no privileges, making the settings-change action reachable by any remote actor. Patchstack tracks this as a settings-change vulnerability affecting push-notification-for-post-and-buddypress.

Critical Impact
Remote unauthenticated attackers can alter plugin settings, potentially redirecting or disrupting push notifications delivered to WordPress and BuddyPress users.

Affected Products

Murali Push Notification for Post and BuddyPress plugin for WordPress
All versions from n/a through 2.11
WordPress sites using BuddyPress with this plugin enabled

Discovery Timeline

2025-02-14 - CVE-2025-23771 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23771

Vulnerability Analysis

The vulnerability arises because the plugin exposes settings-modification functionality without enforcing proper authorization checks. WordPress plugins typically gate administrative actions behind current_user_can() capability checks and nonce validation. The affected plugin omits or misconfigures these checks on one or more settings handlers, allowing requests from unauthenticated sources to succeed.

An attacker sending crafted HTTP requests to the plugin's settings endpoint can change configuration values that control push notification behavior. The flaw is categorized as Broken Access Control and mapped to [CWE-862] Missing Authorization. Exploitation does not require credentials, social engineering, or a foothold on the target site.

The EPSS probability for this CVE is approximately 0.389%, indicating limited observed exploitation activity at the time of writing. However, the low complexity and network reachability mean exposure remains meaningful for WordPress sites running the vulnerable plugin.

Root Cause

The root cause is the absence of capability and nonce verification on settings-handling code paths in push-notification-for-post-and-buddypress through version 2.11. Without a current_user_can('manage_options') gate or check_admin_referer() call, the settings action processes any incoming request that matches the expected parameters.

Attack Vector

The attack vector is network-based. An attacker issues an HTTP POST request to the WordPress site containing the parameters expected by the plugin's settings handler. Because authorization is missing, the plugin accepts and applies the changes. Refer to the Patchstack Vulnerability Report for parameter-level details.

Detection Methods for CVE-2025-23771

Indicators of Compromise

Unexpected changes to Push Notification for Post and BuddyPress plugin settings in the WordPress admin dashboard
HTTP POST requests to plugin admin endpoints originating from unauthenticated sessions or unknown IP addresses
Push notification delivery anomalies, including missing notifications or notifications routed to unexpected destinations

Detection Strategies

Review web server access logs for POST requests targeting /wp-admin/admin.php, /wp-admin/admin-ajax.php, or /wp-admin/options.php with plugin-specific action parameters
Compare current plugin settings against a known-good baseline stored outside the WordPress database
Enable WordPress audit logging to capture option changes tied to the push-notification-for-post-and-buddypress option keys

Monitoring Recommendations

Alert on modifications to plugin option rows in the wp_options table when the request lacks a valid authenticated admin session
Monitor for HTTP 200 responses to unauthenticated requests targeting plugin admin endpoints
Track push notification service configuration keys and API credentials for unauthorized changes

How to Mitigate CVE-2025-23771

Immediate Actions Required

Update the Push Notification for Post and BuddyPress plugin to a version later than 2.11 once a patched release is available
Deactivate and remove the plugin if a patched version is not yet published and the functionality is not essential
Audit current plugin settings and restore known-good values if tampering is suspected

Patch Information

At the time of publication, the vulnerability affects all versions through 2.11. Consult the Patchstack Vulnerability Report for the latest patched version information from the plugin author.

Workarounds

Restrict access to /wp-admin/ paths using a web application firewall (WAF) rule that requires an authenticated session cookie
Block unauthenticated POST requests to plugin admin action endpoints at the reverse proxy or WAF layer
Apply the principle of least privilege by removing the plugin from production sites that do not require BuddyPress push notifications

bash

# Example WAF rule (ModSecurity) blocking unauthenticated POSTs to the plugin's admin actions
SecRule REQUEST_METHOD "@streq POST" \
  "chain,id:1002371,phase:2,deny,status:403,msg:'Block unauth plugin settings change CVE-2025-23771'"
  SecRule REQUEST_URI "@rx /wp-admin/(admin|admin-ajax|options)\.php" \
    "chain"
    SecRule ARGS_NAMES "@rx push[-_]notification[-_]for[-_]post[-_]and[-_]buddypress" \
      "chain"
      SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"