CVE-2026-24536: 
WordPress vulnerability analysis and mitigation

CVE-2026-24536 is a Sensitive Data Exposure vulnerability (CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere) in the Webpushr Web Push Notifications WordPress plugin. It affects all versions up to and including 4.38.0, allowing unauthenticated remote attackers to retrieve embedded sensitive data. The vulnerability was reported on December 26, 2025, published by Patchstack on January 23–25, 2026, and patched in version 4.39.0. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), meaning the plugin exposes sensitive system or configuration data in a context accessible to unauthorized actors. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The flaw allows retrieval of embedded sensitive data — likely API keys, configuration tokens, or similar credentials embedded within the plugin's output or source — which could then be leveraged to attack other components of the system. The vulnerability was discovered by researcher Trương Hữu Phúc (truonghuuphuc) and reported to Patchstack (Patchstack).

Successful exploitation results in a low confidentiality impact — an unauthenticated attacker can access sensitive information (such as embedded API keys or configuration data) that is not intended to be publicly accessible. There is no integrity or availability impact. While the direct impact is limited, exposed credentials or API keys could be used to facilitate further attacks, such as unauthorized access to the Webpushr push notification service or abuse of the associated account (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is very low at approximately 0.018%, indicating a low probability of exploitation in the near term. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

The vendor has released a patched version of the Webpushr Web Push Notifications plugin. Users should update to version 4.39.0 or later immediately. Patchstack users can enable auto-update for vulnerable plugins to automate remediation. If an immediate update is not possible, site administrators should consult their hosting provider or web developer for assistance, and consider temporarily deactivating the plugin until the update can be applied (Patchstack).