The NS Maintenance Mode for WP WordPress plugin up to version 1.3.1 contains a flaw in its subscriber export feature that does not enforce any authorization checks. As a result, anyone who can access the plugin endpoint can trigger the export and receive a file that lists every site subscriber’s name and email address. This vulnerability allows an attacker to obtain personally identifying information that could be used for phishing, spam, or social engineering campaigns. It is an example of an information disclosure weakness (CWE‑200).

The issue exists in the NS Maintenance Mode for WP plugin for WordPress installations running any version through 1.3.1. Administrators who rely on this plugin for site status or maintenance should verify the installed version and ensure it is either upgraded or the export function is disabled.

The vulnerability has a CVSS score of 5.3, indicating moderate severity. The EPSS score is under 1 %, suggesting exploitation is unlikely at present, and the flaw is not listed in the CISA KEV catalog. The attack vector is unauthenticated, meaning no credentials or privileged access are required; any visitor who can reach the export URL can trigger the leak. Given the lack of further controls, the risk is limited to data exposure rather than a more destructive outcome.