CVE-2026-87762

Summary

The Adwised Web Push Notification WordPress plugin has a critical authorization bypass vulnerability that allows unauthenticated users to inject and execute arbitrary JavaScript code on every visitor's browser. This occurs because the plugin lacks proper authorization checks and uses a vulnerable secret comparison method that can be bypassed when the secret key is unset.

Exploitability

Exploitation is straightforward with no prerequisites, requiring only access to the WordPress site to trigger the injection of malicious JavaScript through unprotected endpoints.

Blast radius

The impact could be severe across all visitors since the injected JavaScript executes in every user's browser, potentially leading to session hijacking, data exfiltration, or full client-side compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.5.8 or later to address the authorization bypass and secret comparison vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.