CVE-2026-0816 describes a time-based SQL Injection vulnerability in the All push notification for WP plugin for WordPress, affecting all versions up to 1.5.3. The issue arises from improper neutralization of special elements in the 'delete_id' parameter, allowing authenticated administrators to append SQL queries to existing database commands. This vulnerability is due to insufficient escaping of user input and lack of prepared statements in the plugin's code. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

An attacker with administrator-level access can exploit this vulnerability to perform time-based SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect data integrity or availability but poses a confidentiality risk. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity related to the 'delete_id' parameter. Avoid using the vulnerable plugin version if possible.