EUVD-2026-89916
GHSA-r3rq-3wc8-rgqq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Notivo <= 1.4.2
-
ExploitSend crafted unauthenticated HTTP request
-
ExecutionTrigger exposed data endpoint
-
ImpactRetrieve sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Outbound data filtering
|
| Exploitation Conditions | Requires the Notivo (woo-notification) WordPress plugin at version 1.4.2 or earlier to be installed and active on an internet-reachable site; per the CVSS vector (PR:N/UI:N) no authentication, user interaction, or non-default configuration is indicated, so a default install is exploitable remotely. The primary limiting factor is impact scope - only limited confidentiality data is exposed (C:L, no integrity or availability effect) - and the plugin's comparatively narrow deployment footprint versus core WordPress. |
| Impact | This is a genuinely accessible but low-impact issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms fully remote, unauthenticated exploitation with no user interaction against the Notivo WordPress plugin, which raises real-world exposure since any web-facing site running the plugin is reachable. However, impact is narrow: C:L/I:N/A:N means only limited confidentiality loss (partial data exposure), no integrity or availability effect, hence the moderate 5.3 base score. No EPSS probability, no CISA KEV listing, and no public POC were provided, so there is no signal of active or automated exploitation. SSVC decision inputs (exploitation status, automatable, technical impact) were not supplied. Net: this is a low-to-medium real-world priority - easy to reach but limited payoff for an attacker - rather than a high-urgency flaw. The Patchstack description is sparse (no named parameter, endpoint, or sink), so the exact data exposed cannot be confirmed from available data. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running Notivo <= 1.4.2 and retrieves sensitive information the plugin fails to properly restrict (e.g., an unprotected AJAX/REST endpoint or exposed data file). No login, no user interaction, and no special tooling are required. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Unauthenticated sensitive data exposure in the Notivo WordPress plugin (woo-notification) through version 1.4.2 allows remote attackers to retrieve limited confidential information from affected sites without authentication or user interaction. The CVSS vector (PR:N/UI:N) confirms the issue is remotely exploitable on a default installation, but impact is confined to low confidentiality (C:L) with no integrity or availability effect. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the plugin's narrow deployment footprint limits exposure relative to core WordPress.
RemediationAI
No vendor-released patch version was identified in the provided intelligence; the Patchstack advisory documents the vulnerability in versions up to and including 1.4.2. Check the VillaTheme website or the WordPress plugin repository for a Notivo update beyond 1.4.2 and apply it if available. If no fixed release exists, consider temporarily deactivating the plugin on internet-facing sites where its functionality is not essential. As a compensating control, use a web application firewall to block unauthenticated requests to the plugin's AJAX or REST endpoints - but this may break legitimate front-end notification features that rely on those routes. Additionally, monitor server logs for unusual access to plugin files and limit plugin usage to trusted environments. Refer to the Patchstack advisory for any updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data), indicating that the plugin includes sensitive information in output sent to users without adequate access controls. In the WordPress ecosystem, this typically manifests as an AJAX action, REST API endpoint, or shortcode that fails to perform capability checks, returning data intended for authenticated users (e.g., order notifications, customer details, or plugin configuration) to unauthenticated requests. The affected component is the Notivo (woo-notification) plugin by VillaTheme, identified by CPE cpe:2.3:a:villatheme:notivo:*:*:*:*:*:*:*:* and documented by Patchstack as affecting versions up to and including 1.4.2. No further technical details on the specific vulnerable endpoint were provided in the available intelligence.
Know when Notivo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated remote HTTP access (AV:N/AC:L/PR:N/UI:N) exposing limited sensitive data only (C:L), with no integrity or availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB