What is the CVSS score of CVE-2025-15481?

CVE-2025-15481 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2025-15481?

Yes, a public proof-of-concept exploit is available for CVE-2025-15481. Prioritise patching immediately. EPSS: 0.2%.

Notification Bar CVE-2025-15481

EUVD-2025-210829 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-09-02 WPScan

GHSA-qmqj-jp9x-9qfw

WordPress Authentication Bypass Notification Bar For Wordpress Unknown

5.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible unauthenticated endpoint, no interaction required; confidentiality impact is Low as only subscriber emails are disclosed with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 02, 2026 - 15:17 vuln.today

CVE Published

Sep 02, 2026 - 14:25 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails.

AnalysisAI

Unauthenticated information disclosure in the Notification Bar for WordPress plugin (through v1.1.8) allows any remote attacker to retrieve the full subscriber email list via an exposed CSV export script that performs no authentication or capability check. A publicly available proof-of-concept published by WPScan confirms trivial exploitation requiring only a single HTTP request. The vulnerability is not currently in CISA KEV, but the zero-friction exploitation path creates meaningful privacy and regulatory exposure (GDPR, CAN-SPAM) for any WordPress site running this plugin.

Technical ContextAI

The Notification Bar for WordPress plugin provides an announcement/notification bar UI and collects visitor email subscriptions. The root cause is a missing authentication check on a CSV export route - a WordPress handler or direct PHP script that dumps all stored subscriber records without verifying WordPress user capabilities or nonces. This antipattern (CWE-306, Missing Authentication for Critical Function, is the most applicable class despite NVD recording CWE as N/A) is common in WordPress plugins where admin export features are inadvertently left publicly reachable. The affected CPE cpe:2.3:a:unknown:notification_bar_for_wordpress:*:*:*:*:*:*:*:* covers all versions through 1.1.8, with 'unknown' used as a vendor placeholder.

RemediationAI

No vendor-released patch identified at time of analysis - the CVE description specifies versions 'through 1.1.8' with no fixed version specified. Site administrators should deactivate and remove the Notification Bar for WordPress plugin immediately until a patched release is confirmed. As a compensating control, WAF rules or server-level access restrictions (Nginx location deny, Apache FilesMatch/Redirect rules) can block direct HTTP access to the plugin's CSV export URL path - the specific path is documented in the WPScan PoC at https://wpscan.com/vulnerability/a5fb18fa-be2c-41a5-81ef-ca27de024d34/. Note that WAF-layer blocking does not remediate the underlying missing authentication and should be treated as temporary. Any subscriber email data already harvested by unauthorized parties prior to mitigation cannot be recalled, and affected operators should assess GDPR/CCPA breach notification obligations.