The Notification Bar for WordPress plugin up through version 1.1.8 includes a publicly accessible CSV export script that reveals every stored subscriber email address. The flaw is a lack of authentication checks, which allows an attacker to obtain sensitive data without credentials. The primary consequence is confidentiality compromise of subscriber contact information; there is no code execution or denial of service impact. The vulnerability is classified under CWE‑306, indicating a missing authorization requirement.

WordPress sites running the Notification Bar for WordPress plugin version 1.1.8 or earlier are vulnerable. The plugin is marketed by an unspecified developer; no vendor names are provided beyond the plugin name.

The CVSS score of 5.3 indicates a moderate risk level, and the absence of an EPSS value suggests no publicly reported exploitation incidents. The flaw is not listed in the CISA KEV catalog, implying it has not yet been targeted by known exploits. Because the script is unauthenticated, any user who can reach the site endpoint could invoke it simply by issuing an HTTP request, making the attack vector straightforward and the likelihood of exploitation relatively high for exposed sites.