MEDIUM
WordPress Gravitec.net – Web Push Notifications plugin <= 2.9.17 - Broken Access Control vulnerability
Published Dec 9, 2025
4.3
MEDIUMCVSS 3.1
EPSS 0.24%
Description
Missing Authorization vulnerability in Gravitec.net - Web Push Notifications Gravitec.net – Web Push Notifications gravitec-net-web-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gravitec.net – Web Push Notifications: from n/a through <= 2.9.17.
Affected products
- Vendor Gravitec.net - Web Push Notifications Product Gravitec.net – Web Push Notifications Defaultunaffected
Affected
- ≥ 0, ≤ 2.9.17
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Gravitec.net - Web Push Notifications | Gravitec.net – Web Push Notifications | unaffected | Affected
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (2)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-202015 Advisory
- https://patchstack.com/database/Wordpress/Plugin/gravitec-net-web-push-notifications/vulnerability/wordpress-gravitec-net-web-push-notifications-plugin-2-9-17-broken-access-control-vulnerability?_s_id=cve vdb-entry
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Patchstack
Published Dec 9, 2025
Updated Apr 28, 2026
Reserved Oct 24, 2025
Link CVE-2025-62869
CISA Vulnrichment
Updated Dec 10, 2025
Red Hat
No data
GitHub
No data