Description

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T15:17:36.320Z",
  "pubdate": "2026-09-02T15:17:36.320Z",
  "executiveSummary": "The Notification Bar for WordPress plugin, specifically versions 1.1.8 and below, contains an unauthenticated information disclosure vulnerability. This flaw resides within a CSV export script that fails to implement access control checks, allowing unauthorized users to retrieve sensitive subscriber information.\nThe vulnerability is classified as an improper access control issue. Successful exploitation permits an unauthenticated attacker to remotely dump the entire database of subscriber email addresses associated with the plugin.\nThis impact poses significant privacy and security risks, including the potential for targeted phishing campaigns, spam distribution, and data privacy regulatory non-compliance. The attack requires no prior authentication or administrative privileges, as the vulnerable endpoint is accessible directly via a public-facing URL. The exposure is considered high-risk due to the ease of exploitation and the sensitivity of the PII (Personally Identifiable Information) involved.",
  "technicalDetails": "The vulnerability stems from the plugin's implementation of a backend CSV export functionality that does not verify the requesting user's session or authorization level before processing the request. In the affected versions (1.1.8 and earlier), the script responsible for generating and serving the subscriber list data is exposed to the public web space without being gated by WordPress security nonces or current_user_can() capability checks.\nThe attack flow begins with the discovery of the specific URL path associated with the export script within the plugin's directory structure. Because the application logic lacks a conditional check for authenticated administrative status, any visitor who navigates to the target URL triggers the script's execution.\nUpon receiving the GET request, the script interacts with the underlying database, querying the table designated for storing subscriber data. The script then dynamically generates a CSV file containing the full list of collected email addresses and forces a file download to the requester's browser. No authentication headers or cookies are validated during this process, rendering the endpoint completely exposed over the network.\nExploitation is trivial and can be performed using standard web browser tools or command-line utilities such as curl or wget. The attacker merely needs to send a request to the identified endpoint to receive the full dataset in structured text format. The root cause is an insecure direct object reference (IDOR)-style oversight where the functional component assumes that the absence of a visible UI link implies security, rather than enforcing explicit access control logic within the server-side code.\nThe impact is significant as it facilitates unauthorized bulk data extraction. Once acquired, the stolen email database can be utilized for malicious activities such as social engineering, account takeover (ATO) attacks against the subscribers, or inclusion in external databases for automated spam distribution. The vulnerability persists across all deployments of the plugin version 1.1.8 and below, providing no barrier to entry for automated reconnaissance bots scanning for common WordPress plugin misconfigurations."
}