This vulnerability (CVE-2026-28153) affects Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More versions up to 1.7.1. It is classified as CWE-862: Missing Authorization, meaning that the software does not properly enforce access control checks for certain notification-related functionality. The flaw allows unauthenticated attackers to access sensitive information or functionality that should be restricted. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges or user interaction, with a high impact on confidentiality but no impact on integrity or availability. The vulnerability is published and known but currently lacks an official fix or vendor advisory specifying remediation steps.

An unauthenticated attacker can exploit this broken access control vulnerability to gain unauthorized access to notification-related features or data, potentially exposing sensitive information. The confidentiality impact is high, but there is no reported impact on integrity or availability. This could lead to information disclosure risks in affected WordPress sites using the vulnerable plugin version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the plugin's functionality via other means such as web application firewalls or limiting exposure of the affected WordPress installation. Monitor vendor channels for updates and apply patches promptly once released.