Notification Master CVE-2026-28153

The target WordPress site must have the Notification Master plugin installed and active in a version at or below 1.7.1. No authentication is required - the CVSS vector PR:N confirms unauthenticated exploitation against the default plugin installation. The site must be reachable over the network (AV:N). No special non-default configuration appears required beyond plugin activation. Exploitation is limited to confidentiality impact only; an attacker cannot modify data or disrupt availability through this vector alone. Scope is unchanged (S:U), so lateral movement to other WordPress components or the underlying host through this vulnerability alone is not indicated.

The CVSS 7.5 High score is driven entirely by the favorable attack conditions (AV:N/AC:L/PR:N/UI:N) and high confidentiality impact, which paints a serious picture. In practice, risk should be tempered by the plugin's limited deployment footprint - Notification Master is a niche product - and by the absence of both a CISA KEV listing and any reported public exploit code, both of which would significantly elevate urgency. EPSS data was not provided in the intelligence inputs, so automated exploitation probability cannot be independently assessed. The scope is unchanged (S:U), meaning the attacker cannot pivot to the broader WordPress installation or host OS through this flaw alone. The net assessment is: moderate-high priority for any WordPress administrator running this plugin, but not a broadly emergent threat requiring emergency response across the industry. The C:H rating warrants rapid patching given that webhook secrets or subscriber PII may be exposed.

An unauthenticated attacker sends a crafted HTTP GET or POST request directly to an unprotected WordPress REST API endpoint or AJAX action registered by the Notification Master plugin, bypassing the missing authorization check. The server returns sensitive data - likely subscriber lists, webhook URLs, or API credentials configured in the plugin - without requiring the attacker to hold a WordPress account or session cookie. No public exploit code has been reported, but the low attack complexity and zero privilege requirement make this trivially scriptable once the specific endpoint is identified.