CVE-2026-81279: CWE-862 Missing Authorization in Murali Push Notification for Post and BuddyPress

This vulnerability is classified as CWE-862 (Missing Authorization) and affects the Push Notification for Post and BuddyPress plugin by Murali in versions up to 3.20. The issue allows subscribers to bypass intended access controls, potentially enabling unauthorized actions within the plugin. The CVSS 3.1 base score is 5.4, indicating a medium impact with network attack vector, low attack complexity, and requiring low privileges without user interaction. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

The vulnerability allows unauthorized access or actions by subscribers due to missing authorization checks. The impact is limited to confidentiality and integrity with no availability impact. Exploitation could lead to unauthorized information disclosure or modification within the scope of the plugin's functionality.

No official patch or remediation is currently available. Users should monitor the vendor's advisory channels for updates. Until a fix is released, consider restricting subscriber permissions or disabling the plugin if feasible to reduce exposure.