CVE-2024-6159

CRITICAL NUCLEI

WordPress Plugin <1.9.4 - SQL Injection

Title source: llm

Description

The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

Nuclei Templates (1)

Push Notification for Post and BuddyPress <= 1.93 - SQL Injection
CRITICALVERIFIEDby s4e-io

References (1)

Scores

CVSS v3 9.8
EPSS 0.0984
EPSS Percentile 93.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
pnfpb/push_notification_for_post_and_buddypress < 1.9.4
Published May 15, 2025
Tracked Since Feb 18, 2026