CVE-2025-9895 is a CSRF vulnerability in the umarbajwa Notification Bar WordPress plugin affecting all versions up to 2.2. The issue arises from missing or incorrect nonce validation on the 'subscriber-list-empty.php' endpoint, enabling attackers to craft malicious requests that, when executed by an authenticated administrator, can empty the subscriber list without proper authorization checks. This vulnerability requires user interaction (UI:R) but no privileges (PR:N) and can be exploited remotely (AV:N).

An attacker can cause an authenticated site administrator to unknowingly empty the subscriber list by tricking them into clicking a malicious link or performing a specific action. This results in loss of subscriber data (integrity impact) but does not affect confidentiality or availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking links or performing actions from untrusted sources while logged into the WordPress admin interface. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended.