CVE-2026-28153: CWE-862 Missing Authorization in Notification Master Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More

This vulnerability (CVE-2026-28153) affects Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More versions <= 1.7.1. It is an unauthenticated broken access control issue where authorization checks are missing, potentially allowing unauthorized access to notification features. The CVSS v3.1 score is 7.5, indicating high severity with network attack vector, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. There is no vendor advisory or patch information available at this time.

An attacker can exploit this missing authorization vulnerability without authentication to access sensitive notification functionalities, potentially leading to unauthorized disclosure of information. The impact is limited to confidentiality as per the CVSS vector, with no integrity or availability impact reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin's features via other means such as web application firewalls or limiting plugin usage to trusted users only.