CVE-2026-0816: All Push Notification WP SQLi Vulnerability

CVE-2026-0816 Overview

The All push notification for WP plugin for WordPress contains a time-based SQL Injection vulnerability in the delete_id parameter. This security flaw affects all versions up to and including 1.5.3 and stems from insufficient escaping of user-supplied input combined with a lack of proper preparation on existing SQL queries. Authenticated attackers with administrator-level access can exploit this vulnerability to append malicious SQL queries, potentially extracting sensitive information from the WordPress database.

Critical Impact

Authenticated attackers with administrator privileges can leverage this SQL Injection vulnerability to extract sensitive data from the database, potentially compromising user credentials, configuration settings, and other confidential information stored within WordPress.

Affected Products

• All push notification for WP plugin for WordPress versions up to and including 1.5.3

Discovery Timeline

• February 4, 2026 - CVE-2026-0816 published to NVD
• February 4, 2026 - Last updated in NVD database

Technical Details for CVE-2026-0816

Vulnerability Analysis

This SQL Injection vulnerability exists within the All push notification for WP WordPress plugin's administrative functionality. The flaw resides in the class-pushnotification-admin.php file, specifically around line 95 where the delete_id parameter is processed. Due to inadequate input sanitization and the absence of parameterized queries, user-controlled data flows directly into SQL statements without proper escaping or preparation.

The time-based nature of this SQL Injection means that attackers can infer database contents by observing response time delays caused by injected conditional sleep statements. While the attack requires administrator-level authentication, compromised admin accounts or insider threats could leverage this vulnerability to exfiltrate sensitive database contents including user credentials, email addresses, and plugin configuration data.

Root Cause

The root cause of this vulnerability is improper input validation combined with unsafe database query construction. The delete_id parameter accepts user input that is directly concatenated into SQL queries without using WordPress's prepared statement functions such as $wpdb->prepare(). This failure to properly sanitize and escape user-supplied data before incorporating it into SQL statements creates the injection point that attackers can exploit.

Attack Vector

The attack vector is network-based, requiring an authenticated session with administrator privileges. An attacker would need to:

1. Obtain valid administrator credentials through phishing, credential stuffing, or other means
2. Navigate to the plugin's administrative interface
3. Manipulate the delete_id parameter with time-based SQL injection payloads
4. Observe response timing to extract database information character by character

The vulnerability can be exploited by injecting SQL sleep commands to create measurable delays, allowing blind data extraction from the WordPress database. For detailed technical analysis, refer to the Wordfence Vulnerability Report and the vulnerable code in the WordPress plugin repository.

Detection Methods for CVE-2026-0816

Indicators of Compromise

• Unusual database query patterns or extended query execution times in MySQL slow query logs
• HTTP requests to plugin administrative endpoints containing SQL syntax in the delete_id parameter
• Abnormal administrator session activity, particularly repetitive requests to notification deletion functionality
• Database error logs showing malformed SQL queries or syntax errors

Detection Strategies

• Deploy web application firewalls (WAF) with SQL Injection detection rules targeting the affected plugin endpoints
• Monitor WordPress admin activity logs for suspicious parameter manipulation in push notification plugin requests
• Implement database query monitoring to detect time-based injection patterns such as SLEEP(), BENCHMARK(), or WAITFOR DELAY statements
• Review web server access logs for requests containing encoded SQL keywords directed at the plugin's admin class

Monitoring Recommendations

• Enable WordPress debug logging and audit plugin administrative actions
• Configure database slow query logging to capture queries exceeding normal execution thresholds
• Implement real-time alerting for SQL injection attack patterns in WAF or IDS/IPS solutions
• Regularly audit administrator account activity for unauthorized access attempts

How to Mitigate CVE-2026-0816

Immediate Actions Required

• Update the All push notification for WP plugin to a patched version when available
• Temporarily deactivate the plugin if it is not critical to site operations
• Implement WAF rules to block SQL injection attempts targeting the delete_id parameter
• Audit administrator accounts and revoke access for any compromised or unnecessary accounts
• Review database access logs for signs of prior exploitation

Patch Information

Organizations should monitor the WordPress plugin repository for an updated version of All push notification for WP that addresses this SQL Injection vulnerability. The fix should implement proper input sanitization using WordPress's $wpdb->prepare() function or equivalent parameterized query methods. Refer to the WordPress plugin repository for updates and the Wordfence advisory for patch availability information.

Workarounds

• Restrict administrator access to trusted IP addresses using .htaccess or server firewall rules
• Implement additional authentication factors for WordPress admin accounts to reduce risk of credential compromise
• Deploy a web application firewall with strict SQL injection filtering for WordPress administrative endpoints
• Consider using a security plugin that provides virtual patching capabilities for known vulnerabilities

# Example .htaccess configuration to restrict admin access by IP
<Files wp-login.php>
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Files>

# Block access to plugin admin pages from untrusted sources
<Directory "/var/www/html/wp-content/plugins/all-push-notification/pushnotification-admin">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
</Directory>