CVE-2026-28153

WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerability

View on CVE.org

Published Aug 24, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

Unauthenticated Broken Access Control in Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More <= 1.7.1 versions.

Analysis

Technical impact

A flaw in the Notification Master WordPress plugin enables unauthenticated actors to bypass normal access controls. The vulnerability permits attackers to perform privileged operations on the notification system, potentially exposing sensitive configuration data, manipulating automated alerts, or hijacking the notification workflow. The weakness is identified as CWE‑862: Broken Access Control.

Affected Systems

The problem exists in the Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin for versions up to and including 1.7.1. Systems running any affected version of this plugin are vulnerable.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no currently known widespread exploitation. Attackers can exploit the flaw via the plugin’s web interfaces without authentication, making the risk moderate to high for sites that host the plugin in a publicly reachable environment.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Notification Master

Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More

unaffected

Version	Status	Constraints
`n/a`	affected	≤ 1.7.1

No data.

Vendor Product Versions

Notification Master

Notification Master – Real-time Wordpress Notifications With Email, Sms, Webhooks & More

Version	Status	Scheme	Platform
`[0,1.7.1]`	affected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Notification Master to the latest version (1.7.2 or newer) because the patch resolves the access control issue.
If an upgrade is delayed, disable or delete the plugin’s endpoints via WordPress admin or through a .htaccess rule to block unauthenticated access.
Implement a Web Application Firewall or use a security plugin to block requests to the notification master routes until the issue is fixed.

Generated by OpenCVE AI on August 24, 2026 at 13:27 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.428% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/wordpress/plugin/notification-master/vulnerability/wordpress-notification-master-real-time-wordpress-notifications-with-email-sms-webhooks-more-plugin-1-7-1-broken-access-control-vulnerability?_s_id=cve

History

Aug 24, 2026 9:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Notification Master Notification Master notification Master – Real-time Wordpress Notifications With Email, Sms, Webhooks & More Wordpress Wordpress wordpress
Vendors & Products		Notification Master Notification Master notification Master – Real-time Wordpress Notifications With Email, Sms, Webhooks & More Wordpress Wordpress wordpress

Aug 24, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 24, 2026 12:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Unauthenticated Broken Access Control in Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More <= 1.7.1 versions.
Title		WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerability
Weaknesses		CWE-862
References		https://patchstack.com/database/wordpress/plugin/notification-master/vulnerability/wordpress-notification-master-real-time-wordpress-notifications-with-email-sms-webhooks-more-plugin-1-7-1-broken-access-control-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`