Description

Unauthenticated Broken Access Control in Notification Master &#8211; Real-Time WordPress Notifications With Email, SMS, Webhooks &amp; More <= 1.7.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-24T12:16:50.347Z",
  "pubdate": "2026-08-24T12:16:50.347Z",
  "executiveSummary": "The Notification Master plugin for WordPress is affected by an unauthenticated broken access control vulnerability in versions 1.7.1 and prior.\nThis security flaw exposes the application to unauthorized data access and administrative action execution without requiring valid user authentication.\nThe affected product, Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More, fails to properly validate the authorization state of incoming requests to sensitive functionality.\nThe risk implications are severe, as unauthenticated malicious actors can leverage this vulnerability over the network to interact with notification endpoints, potentially leading to unauthorized data exposure, configuration tampering, or further compromise of the underlying WordPress installation.\nExploitation requirements are minimal, as the attacker needs no prior privileges or valid session tokens to target the exposed endpoints.\nThis vector presents a significant threat posture to website integrity and data confidentiality, requiring immediate remediation to prevent malicious exploitation.",
  "technicalDetails": "The vulnerability resides in the access control implementation of the Notification Master plugin, specifically impacting versions 1.7.1 and below.\nThe root cause stems from missing or inadequate authorization checks on critical AJAX actions, REST API endpoints, or administrative functions handled by the plugin.\nBecause the vulnerable component fails to verify whether the requesting party possesses the necessary privileges or valid authentication tokens, unauthenticated attackers can invoke restricted functions directly via HTTP requests over the network.\nThe attack flow typically proceeds as follows: an external attacker crafts an unauthenticated HTTP request targeting specific endpoints exposed by the Notification Master plugin.\nDue to the absence of proper nonce verification, capability checks (such as current_user_can), or session validation within the vulnerable component's request handling logic, the application processes the incoming payload as a legitimate administrative or authorized transaction.\nDepending on the exact functionality exposed by the affected endpoints, payload behavior may allow unauthorized retrieval of notification logs, modification of system settings, dispatch of arbitrary notifications, or execution of unintended backend routines.\nThe network exposure is absolute for any publicly accessible WordPress site running the vulnerable versions, as the endpoints are reachable via standard web traffic protocols.\nPost-exploitation impact includes unauthorized exposure of sensitive operational data, tampering with notification workflows, and potential leverage of the plugin's capabilities to facilitate broader attacks against the host environment."
}