PatchSiren cyber security CVE debrief
CVE-2026-28153 Notification Master CVE debrief
CVE-2026-28153 is a high-severity vulnerability in the Notification Master plugin for WordPress, affecting versions up to 1.7.1. It allows unauthenticated attackers to bypass access controls, potentially leading to unauthorized access to sensitive information. Defenders should assess exposure and prioritize remediation. The vulnerability's impact is significant because it could allow attackers to access sensitive information without proper authorization. This could lead to data breaches or other security incidents. The CVE record and NVD entry provide limited information about the vulnerability, but indicate that it is a high-severity issue affecting the Notification Master plugin.
- Vendor
- Notification Master
- Product
- Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More
- CVSS
- HIGH 7.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-24
- Original CVE updated
- 2026-10-12
- Advisory published
- 2026-08-24
- Advisory updated
- 2026-10-12
Who should care
Defenders responsible for WordPress installations using the Notification Master plugin should assess exposure and prioritize remediation. This includes verifying the version of the plugin in use and updating to a patched version if necessary. Additionally, defenders should monitor for potential unauthorized access to sensitive information and review compensating controls for exposed systems while remediation is being
Why it matters
CVE-2026-28153 is a high-severity vulnerability in the Notification Master plugin for WordPress that allows unauthenticated attackers to bypass access controls. Defenders should prioritize verifying the version of the plugin in use and updating to a patched version if necessary.
- Potential unauthorized access to sensitive information
- Need to verify plugin version and update to a patched version
Technical summary
CVE-2026-28153 is a high-severity vulnerability in the Notification Master plugin for WordPress, affecting versions up to 1.7.1. It allows unauthenticated attackers to bypass access controls, potentially leading to unauthorized access to sensitive information.
Defensive priority
Defenders should prioritize verifying the version of the Notification Master plugin in use and updating to a patched version if necessary.
Recommended defensive actions
- Verify the version of the Notification Master plugin in use
- Update to a patched version if necessary
- Monitor for potential unauthorized access to sensitive information
Evidence notes
The CVE record and NVD entry provide limited information about the vulnerability, but indicate that it is a high-severity issue affecting the Notification Master plugin.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-28153 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-28153
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-28153 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-28153
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.