CVE-2025-15481: CWE-306 Missing Authentication for Critical Function in Notification Bar for WordPress

The Notification Bar for WordPress plugin through version 1.1.8 contains a missing authentication vulnerability (CWE-306) in its CSV export functionality. This flaw allows unauthenticated attackers to access a script that exports subscriber email addresses without any access control, resulting in disclosure of all stored subscriber emails. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact. No official patch or remediation guidance is currently available from the vendor or advisory sources.

An attacker can retrieve all subscriber email addresses stored by the Notification Bar plugin without authentication. This compromises subscriber privacy and may facilitate spam, phishing, or other targeted attacks. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the CSV export functionality if possible, such as by limiting web access to trusted users or disabling the export feature. Monitor official vendor channels for updates or patches addressing this vulnerability.