WordPress for Android: Notifications Can Be Switched Off by Any Installed App

Any app installed after WordPress receives the exported receiver's permission without a prompt and switches the app's notifications off, with no user interaction.

Advisory ID: TP-2026-119
Product: WordPress for Android (official WordPress app for Android by Automattic)
Vulnerability type: Incorrect default permissions (CWE-276)
CVE: not requested
CVSS 3.1: 5.1 (Medium) · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected versions: up to and including 27.2 (confirmed on 27.0, flavour org.wordpress.android)
Fixed in: 27.3
Reported: 3 August 2026

Summary

WordPress for Android is Automattic's official app for managing WordPress sites. The app exports the broadcast receiver JetpackAppInstallReceiver, which switches the app's notifications off globally on receipt and is meant to be reachable only by Automattic's Jetpack app. Its only guard is the app's own permission org.wordpress.android.permission.DISABLE_NOTIFICATIONS, whose declaration sets no android:protectionLevel and therefore falls back to normal. Android grants a normal permission at install time to every app that requests it in its manifest, with no prompt and no signature check. Any app installed afterwards turns off the master notification switch, clears displayed notifications and cancels scheduled reminders, with no user interaction and without WordPress running.

Root cause

WordPress/src/wordpress/AndroidManifest.xml:5-8 declares ${applicationId}.permission.DISABLE_NOTIFICATIONS with only android:label and android:description, so the omitted android:protectionLevel falls back to normal. WordPress/src/wordpress/AndroidManifest.xml:17-24 exports JetpackAppInstallReceiver with that permission as its only access control and an intent filter for org.wordpress.android.broadcast.DISABLE_NOTIFICATIONS. onReceive ignores the received intent entirely and calls updateNotificationSettings(false) and removeAllNotifications (WordPress/src/wordpress/java/org/wordpress/android/ui/mysite/jetpackbadge/JetpackAppInstallReceiver.kt:27-36). UpdateNotificationSettingsUseCase writes the preference wp_pref_notifications_main to false and cancels the Weekly Roundup and all blogging reminders (WordPress/src/main/java/org/wordpress/android/ui/prefs/notifications/usecase/UpdateNotificationSettingsUseCase.kt:28-46). That preference decides in showNotificationForBuilder whether any push notification is displayed (WordPress/src/main/java/org/wordpress/android/push/GCMMessageHandler.java:788-799).

Proof of Concept

$ adb shell dumpsys package org.wordpress.android | grep -A2 "declared permissions"
      org.wordpress.android.permission.DISABLE_NOTIFICATIONS: prot=normal, INSTALLED

// attacking app manifest
<uses-permission android:name="org.wordpress.android.permission.DISABLE_NOTIFICATIONS" />

// attacking app code
Intent n = new Intent("org.wordpress.android.broadcast.DISABLE_NOTIFICATIONS");
n.setComponent(new ComponentName("org.wordpress.android",
        "org.wordpress.android.ui.mysite.jetpackbadge.JetpackAppInstallReceiver"));
n.addFlags(Intent.FLAG_INCLUDE_STOPPED_PACKAGES);
ctx.sendBroadcast(n);

before: wp_pref_notifications_master absent (default true)
after:  <boolean name="wp_pref_notifications_master" value="false" />

The attacking app is signed with an arbitrary key of its own and installed after WordPress, so it receives the normal permission automatically (granted=true). The broadcast cold-starts the stopped WordPress app in the background and sets the master notification switch to off without any prompt.

Impact

  • Master notification switch of the WordPress app turned off by any installed app, with no prompt and no user interaction.
  • Displayed notifications cleared, scheduled blogging reminders and the Weekly Roundup cancelled.
  • Repeatable after the user switches it back on; the app does not have to be in the foreground.
  • Bounded: account, sites, credentials and content stay out of reach, and the login-approval push is not suppressed.

References

Is Something Like This in Your Software?

Our team found this vulnerability in the course of its work. Have your applications tested by the same specialists, with a penetration test from turingpoint.

Request a Pentest