Executive brief
The Notification Bar for WordPress plugin is vulnerable to unauthenticated access to a CSV export script that exposes all subscriber email addresses stored in the plugin's database. An attacker can directly access the export script without any credentials to download a complete list of subscriber emails, potentially exposing customer contact information and enabling further targeted attacks such as phishing or spam campaigns.
Technical details
The plugin through version 1.1.8 exposes the CSV export functionality via a publicly accessible script at /wp-content/plugins/8-degree-notification-bar/inc/backend/blocks/export-csv.php without authentication or authorization controls. This allows unauthenticated attackers to trigger the export and retrieve all stored subscriber email addresses. The vulnerability is classified as SQL injection (CWE-89), likely in the database query used to retrieve subscriber data. The attack requires only network access to the WordPress site and no user interaction; a direct HTTP request to the vulnerable script triggers the disclosure. No patch is currently available.
Affected products
- 8 Degree Notification Bar for WordPress through 1.1.8
Timeline
- 2025-04-01: disclosed
- 2026-01-08: advisory
- 2026-09-02: published