CVE-2025-62869

Name of the Vulnerable Software and Affected Versions Gravitec.net – Web Push Notifications versions prior to 2.9.18

Description The plugin contains a missing authorization flaw resulting from an incorrectly configured access control security level. Specifically, a function lacks a proper capability check, allowing authenticated users with subscriber-level access or higher to perform unauthorized actions.

Recommendations Update the plugin to a version later than 2.9.17.