The Notification Bar plugin for WordPress contains a CSRF vulnerability in the subscriber-list-empty.php file caused by missing or incorrect nonce validation. An attacker can trick a site administrator into clicking a forged link to trigger a request that empties the entire subscriber list. The impact is a non‑authentication‑based data modification that removes all stored subscriber contacts, potentially disrupting marketing or communication channels and erasing leads that the site owner has accumulated.

Any WordPress site running the Notification Bar plugin version 2.2 or earlier, including all deployments of the umarbajwa:Notification Bar product. The vulnerability affects the plugin’s functionality that allows administrators to delete subscribers via a request to subscriber‑list‑empty.php.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of <1% suggests a very low probability of exploitation. The issue is not listed in the CISA KEV catalog. Exploitation requires a social‑engineering vector to convince an administrator to send the forged request; no direct code‑execution or remote‑code features are present. The lack of nonce checking is the root weakness, categorized as CWE-352.