CVE-2026-0816: 
WordPress vulnerability analysis and mitigation

CVE-2026-0816 is a time-based SQL injection vulnerability in the "All push notification for WP" plugin for WordPress, affecting all versions up to and including 1.5.3. The flaw exists in the delete_id parameter due to insufficient escaping of user-supplied input and lack of proper SQL query preparation. It was published on February 4, 2026, with a CVSS v3.1 base score of 4.9 (Medium), requiring administrator-level authentication to exploit (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The delete_id parameter in the plugin's admin class (class-pushnotification-admin.php, line 95) is not properly escaped or prepared before being incorporated into SQL queries, enabling time-based blind SQL injection. An authenticated attacker with administrator privileges can append malicious SQL clauses to existing queries to enumerate and extract data from the WordPress database (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated administrator to extract sensitive information from the WordPress database, including user credentials, configuration data, and any other stored content. The confidentiality impact is rated High, while integrity and availability are unaffected. Because exploitation requires administrator-level access, the practical blast radius is limited, though a compromised admin account or a malicious plugin scenario could still result in significant data exposure (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.023% (0.000230), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The requirement for administrator-level authentication significantly limits the attack surface (Wordfence).

1. Authentication: Obtain or compromise WordPress administrator credentials for a site running the "All push notification for WP" plugin version ≤1.5.3.
2. Identify the vulnerable endpoint: Navigate to the plugin's admin panel where the push notification deletion functionality is exposed, which processes the delete_id parameter.
3. Craft a time-based SQL injection payload: Inject a time-delay payload into the delete_id parameter (e.g., 1 AND SLEEP(5)--) to confirm the injection point by observing delayed server responses.
4. Enumerate the database: Use tools such as sqlmap with session cookies to automate extraction of database names, table names, and sensitive data (e.g., sqlmap -u "<target>/wp-admin/..." --cookie="..." -p delete_id --technique=T --dbs).
5. Extract sensitive data: Target the wp_users table or other sensitive tables to retrieve hashed passwords, email addresses, or other confidential information (Wordfence, WordPress Trac).

• Logs: WordPress or web server access logs showing unusual or repeated requests to the plugin's admin deletion endpoint with anomalous delete_id values containing SQL keywords (e.g., SLEEP, BENCHMARK, AND, OR, --).
• Database: Unexpected or high-volume database query activity originating from the WordPress application, particularly time-delayed queries associated with the push notification plugin.
• Network: Unusual response time patterns (consistent multi-second delays) on admin-side requests to the plugin endpoint, indicative of time-based blind SQL injection probing.

Users should update the "All push notification for WP" plugin to version 1.5.4 or later, which addresses the insufficient escaping and SQL preparation issues. As a temporary measure, administrators can deactivate or remove the plugin until patching is feasible. Restricting WordPress admin access to trusted IP addresses and enforcing strong, unique administrator credentials further reduces risk (Wordfence).