CVE-2026-87762: Unauthenticated Stored XSS in Adwised Web Push Notification WordPress Plugin (Through 2.5.7)

Summary

CVE-2026-87762 is a high-severity vulnerability in the Adwised Web Push Notification plugin for WordPress, affecting all versions through 2.5.7. Scored 8.8 on the CVSS 3.1 scale (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and classified as CWE-79, it allows an unauthenticated attacker to store arbitrary JavaScript that is executed in the browser of every site visitor. The root cause is twofold: several state-changing operations lack authorization checks, and the secret comparison the plugin uses as a substitute can be bypassed on installations where the secret key has never been set.

Technical Analysis

The vulnerability is best understood as two weaknesses chained together, with stored cross-site scripting as the end state.

Missing authorization on state-changing operations

According to the vulnerability description, the plugin exposes several state-changing operations that do not perform authorization checks. In a properly hardened WordPress plugin, any operation that modifies persistent state — settings, stored content, configuration values — should be gated behind capability checks and nonce verification, so that only users with sufficient privileges, acting with a valid intent token, can trigger it. On the affected versions, those checks are absent. The description does not enumerate which specific operations are affected, only that there are several.

A secret comparison as a substitute control

Rather than real authorization, the plugin relies on a secret comparison to decide whether an incoming request is legitimate. That substitute control fails under a specific and common condition: the description states that the comparison "can be bypassed on installations where the secret key has never been set."

The exact implementation of the comparison is not fully disclosed. The failure pattern itself, however, is a familiar one in WordPress plugin code: options that have never been configured typically resolve to an empty value, and a comparison between a request-supplied secret and an empty or unset stored value can succeed trivially — for example, when the attacker supplies nothing, or an empty string, in place of the secret. The provided description confirms the bypass condition (a never-set secret key) but does not disclose the precise comparison logic, so anything beyond that condition should be read as analysis rather than disclosed fact.

From bypassed check to stored XSS

The end state of the chain is stored (persistent) cross-site scripting: an unauthenticated user can store arbitrary JavaScript through one of the affected state-changing operations, and that JavaScript is executed in the browser of every site visitor. Because the payload is stored rather than reflected, no crafted link is needed for each victim — the malicious script fires for anyone who loads the page where the stored content renders. The CVSS user-interaction metric (UI:R) is consistent with this model: the required "interaction" is simply a visitor browsing the site.

The CVSS vector rates the attack as network-exploitable (AV:N) with low attack complexity (AC:L) and no privileges required (PR:N) — an attacker needs nothing more than the ability to send requests to the target site. Scope is unchanged (S:U), and confidentiality, integrity and availability are all rated high (C:H/I:H/A:H), reflecting what arbitrary script execution across an entire visitor audience can achieve in practice.

There is also a defensive-design lesson embedded in this CVE: a shared secret is not an authorization model. Secrets can be unset by default, can leak, and cannot express per-user intent the way capabilities and nonces do. When a plugin substitutes a secret check for authorization, any weakness in the secret's lifecycle — including the "never configured" default state — becomes an authentication bypass for the operations it was meant to protect.

Affected Software and Versions

Product: Adwised Web Push Notification, a WordPress plugin.
Affected versions: all versions through 2.5.7 — every release up to and including 2.5.7.
Fixed version: not stated in the sources available for this CVE. Site owners should check the plugin's official listing for an updated release.
Platform: WordPress.
Weakness class: CWE-79 (cross-site scripting), reached through missing authorization checks and a bypassable secret comparison.
CVSS 3.1: 8.8 — AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

The vendor name is not provided in the available data. The description also does not enumerate the individual state-changing operations affected, and no fixed release is identified in the referenced sources.

Impact

The direct impact is persistent, site-wide script execution: arbitrary JavaScript stored by an unauthenticated attacker runs in the browser of every site visitor. In practical terms, the attacker's code runs against the site's entire audience, not against a single tricked user, and it keeps running until the stored content is removed or the plugin is fixed.

Typical consequences of arbitrary JavaScript executing in visitors' browsers include:

Theft of session tokens or other in-page data accessible to scripts on the affected origin.
Manipulation of page content — injected forms, fake login prompts, altered messaging — which can be turned into phishing against the site's own audience.
Redirection of visitors to attacker-controlled destinations.
Delivery of secondary payloads, such as scripts that fingerprint visitors or attempt further exploitation.

These consequences follow from the general capabilities that arbitrary script execution under CWE-79 provides. The description confirms the core fact — arbitrary JavaScript stored and executed for every visitor — without detailing specific attacker tooling or payloads, and none should be assumed.

Site visitors are not limited to anonymous readers. On a WordPress site, the audience browsing the front end can include authenticated users — subscribers, editors, administrators — and script executing in an authenticated user's browser operates within that user's session context on the affected pages. This amplification is a general property of stored XSS on high-traffic origins; the description does not detail any specific privilege escalation, so it should be treated as risk context rather than a confirmed outcome.

There is a second dimension to the impact: the entry point is a set of state-changing operations. An attacker who bypasses the secret check is not limited to injecting script content — they can change plugin state through those operations. The full range of state changes available to the attacker is not disclosed in the provided description.

The CVSS impact ratings (C:H/I:H/A:H) are consistent with this picture: high confidentiality impact (visitor-side data exposure), high integrity impact (content and state manipulation), and high availability impact (script that can disrupt the browsing experience for the entire audience).

Exploitation Scenario

The following scenario is illustrative and derived from the vulnerability description. The sources for this CVE do not disclose endpoint paths, parameter names or request formats, so the steps are intentionally generic.

An attacker identifies a WordPress site running the Adwised Web Push Notification plugin at version 2.5.7 or older, where the plugin's secret key has never been configured — the condition under which the described bypass applies.
The attacker sends an unauthenticated request targeting one of the plugin's state-changing operations that lacks authorization checks.
The plugin evaluates its secret comparison against the never-set secret key. Per the described bypass, the check passes on such installations.
The accepted request stores attacker-controlled JavaScript in the site's persistent state.
From that point on, every visitor's browser executes the stored JavaScript when the affected content renders. The attacker can harvest visitor-side data, alter what visitors see, or redirect them — all without ever authenticating to WordPress.

The defining property of this scenario is the absence of any privileged account: the entire chain, from the first request to persistent script execution, is carried out by an unauthenticated user (PR:N in the CVSS vector), and it requires no more than network access to the target and the default, never-configured state of the plugin's secret key.

Detection and Mitigation

Detection

Inventory: identify WordPress installations where the Adwised Web Push Notification plugin is active, and check the installed version. Versions through 2.5.7 fall within the affected range.
Configuration check: determine whether the plugin's secret key has ever been set. The described bypass condition applies to installations where it has never been set.
Content review: because the vulnerability allows stored JavaScript, review plugin-managed stored content and site pages for unexpected script tags or event handlers. No specific indicators of compromise are provided in the sources for this CVE.
Log review: look for unauthenticated requests that trigger state-changing plugin operations, particularly from clients with no prior interaction with the site.

Mitigation

Update first: the provided sources do not state a fixed version. Check the plugin's official WordPress listing or vendor channel for a release addressing CVE-2026-87762 and update as soon as one is available.
Remove if unused: if the plugin is not required, deactivate and delete it. An unauthenticated attack chain that reaches every visitor is difficult to compensate for with perimeter controls alone.
Configure the secret key: the description ties the bypass to installations where the secret key has never been set. Configuring the secret key plausibly removes that specific bypass condition — this is an inference from the description, not a confirmed fix, and the description does not state whether installations with a configured secret are fully protected from the underlying missing-authorization issue.
Compensating controls: a web application firewall or WordPress hardening layer can filter obvious unauthenticated write attempts and stored script patterns, but these are stopgaps; the flaw itself lives in the plugin's authorization design.
Post-incident response: if exploitation is suspected, review stored plugin content and rendered pages for injected JavaScript, remove any malicious content, and rotate credentials or tokens that could have been exposed to visitor-side script execution.

Bug Bounty Angle

For bug bounty hunters and offensive researchers, CVE-2026-87762 is a textbook example of a pattern that generalizes well beyond this one plugin.

Hunt the pattern, not just the CVE: plugins that gate unauthenticated, state-changing routes behind a "secret key" comparison instead of WordPress nonces and capability checks are worth probing on any engagement where the target is in scope. The highest-value test case is the default install: send state-changing requests with the secret omitted, empty, or set to a plausible default, and observe whether the change persists.
Test the unset-default path: the bypass here hinges on a secret that was never configured. Fresh installs, staging environments and sites where administrators skipped configuration are exactly where this class of flaw bites. When reproducing on an authorized target, confirm the installed version is within the affected range (through 2.5.7) before testing.
Maximize the impact narrative: stored XSS that fires for every site visitor maps to high confidentiality, integrity and availability ratings, as this CVSS vector shows (C:H/I:H/A:H). When writing up a finding of this class, demonstrate persistence and audience-wide execution — that is what separates a high-scored stored bug from a low-scored reflected one.
Chain the state change: the underlying flaw is missing authorization on state-changing operations, not merely an injection sink. Enumerate what else those operations can modify; a bypassed secret check that also alters plugin configuration may be reportable beyond the XSS itself.
Respect scope and authorization: this class of testing is only legitimate against systems you are explicitly permitted to test. WPScan's vulnerability page for this CVE is the appropriate public source for verifying affected versions and disclosure details.

Frequently Asked Questions

What is CVE-2026-87762?

A high-severity (CVSS 8.8) unauthenticated stored cross-site scripting vulnerability in the Adwised Web Push Notification WordPress plugin through version 2.5.7, caused by missing authorization checks combined with a bypassable secret comparison.

Which plugin versions are affected?

All versions of the Adwised Web Push Notification plugin through 2.5.7. The sources available for this CVE do not state a fixed version, so site owners should check the plugin's official listing for updates.

When can the secret comparison be bypassed?

On installations where the plugin's secret key has never been set. The description does not disclose whether installations with a configured secret key are affected by the underlying missing-authorization issue.

Who discovered CVE-2026-87762?

The vulnerability was discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso, with the CVE assigned by WPScan.

Discovery and Credits: CVE-2026-87762 was discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso, and the CVE was assigned by WPScan.