This vulnerability in the 'All push notification for WP' plugin allows an attacker to exploit a Cross-Site Request Forgery (CSRF) flaw to trigger Blind SQL Injection attacks. The affected versions include all versions up to 1.5.3. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity, no privileges required, but requires user interaction. The impact includes high confidentiality loss and low availability impact. The vulnerability is published and tracked under CVE-2025-32547, but no patch or vendor advisory is currently available.

Successful exploitation could allow an attacker to perform Blind SQL Injection via CSRF, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and partial disruption of service (low availability impact). Integrity impact is not indicated. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or removing the affected plugin or restricting access to trusted users only. Monitor official vendor channels for updates and apply any official fixes promptly once released.