Push Notification for Post and BuddyPress WordPress Plugin SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Push Notification for Post and BuddyPress WordPress plugin, affecting versions prior to 1.9.4. The issue arises because the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement. This vulnerability is accessible through an AJAX action available to unauthenticated users.

Impact

Exploitation of this vulnerability allows for unauthorized SQL injection, which could lead to database manipulation or disclosure of sensitive information.

Remediation

Users are advised to update the Push Notification for Post and BuddyPress WordPress plugin to version 1.9.4 or later.