PWA for WP & AMP <= 1.7.88.1 - Unauthenticated Sensitive Information Exposure via Publicly Accessible FCM Service-Account JSON File
- ID
- WPSEC-2026-0905
- Plugin
- PWA for WP – Progressive Web Apps Made Simple (pwa-for-wp)
- Affected
- all versions before 1.7.88.2
- Remediation
- Update to 1.7.88.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-552
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-14
- Attack surface
- PWA for WP & AMP on WPSec AttackSurface
- Fix released
- Published
Description
The PWA for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.88.1 due to the uploaded Firebase Cloud Messaging (FCM) service-account JSON file being stored in the publicly accessible wp-content/uploads/pwaforwp-private/ directory under a predictable name (service-account-<unix timestamp>.json), without any web server deny rules or index file. This makes it possible for unauthenticated attackers to guess the timestamp-based filename and download the service-account credentials, including the Google private key, which could be abused to access the site's Firebase project. Exploitation requires that an administrator has uploaded an FCM service-account JSON file for push notifications.
References
- https://wpsec.com/vuln/WPSEC-2026-0905/
- https://plugins.svn.wordpress.org/pwa-for-wp/tags/1.7.88.2/
- https://wordpress.org/plugins/pwa-for-wp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS