CVE-2026-52698: WordPress PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget plugin <= 4.2.3 - Sensitive Data Exposure vulnerability

Synopsis

A sensitive data exposure vulnerability affects the PushEngage WordPress plugin (Web Push Notifications, eCommerce Automation and Chat Widget) at version 4.2.3 and earlier. The flaw is reachable over the network and requires only a low-privilege subscriber account, meaning any registered WordPress user can trigger it without admin rights. Successful exploitation allows an attacker to read, modify, or partially disrupt subscriber data with scope that extends beyond the plugin itself into the broader WordPress environment. HarborGuard is tracking the advisory for patch availability, as no fix version has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationRequired

  A low-privilege account (subscriber level) is sufficient; no administrator or elevated credentials are needed.

• Victim interactionNot required

  The attacker does not need to trick any user into taking an action; exploitation is direct once the attacker is authenticated.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special preconditions, race conditions, or environmental factors.

Blast Radius

• Reads subscriber data stored by the PushEngage plugin, which may include push notification subscriber identifiers and associated contact details.
• Modifies plugin-managed subscriber records, potentially corrupting notification targeting or injecting attacker-controlled data.
• Causes partial disruption to plugin functionality, degrading push notification delivery or eCommerce automation workflows.
• The changed scope (S:C) means impact can extend beyond the plugin into adjacent WordPress components or data accessible to the plugin's execution context.