CVE-2026-107417: Missing Authorization in Muralidharan Ramasamy Push Notification for Post and BuddyPress

The vulnerability identified as CVE-2026-107417 exists in the Push Notification for Post and BuddyPress plugin by Muralidharan Ramasamy. It is a missing authorization issue that results from incorrectly configured access control security levels. This allows unauthorized remote attackers to perform actions that should require authorization, impacting confidentiality and integrity. The affected versions are all releases from initial through 3.23 inclusive. There is no information about available patches or vendor advisories in the provided data.

Exploitation of this vulnerability could allow an unauthenticated attacker to bypass access controls, leading to limited confidentiality and integrity impacts. There is no indication of availability impact. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and unchanged scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's functionalities and monitor for unusual activity related to push notifications. Avoid exposing the plugin's interfaces to untrusted users.