CVE-2025-15481: Notification Bar for WordPress <= 1.1.8 – Unauthenticated Subscriber Data Disclosure
Published Sep 2, 2026
·Updated
The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails.
Affected Software
1 affected component
WordPress plugin "Notification Bar"<=1.1.8
Event History
Sep 2, 2026
CVE Published
via MITRE·02:25 PM
Data Sourced
via MITRE·02:25 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Any unauthenticated remote user can access the exposed CSV export script; no WordPress account or user interaction is required.
2
What information can be disclosed?
The export exposes all stored subscriber email addresses in CSV form. The provided data does not indicate disclosure of other subscriber fields or WordPress data.
3
How can I determine whether my site is affected?
Sites using the Notification Bar for WordPress plugin at version 1.1.8 or earlier are affected according to the available information. Review whether the plugin is installed and whether it contains stored subscriber email addresses.