TLDRVuln - Cybersecurity Vulnerabilities Made Simple

CVE-2025-10638

Medium · published October 22, 2025

CVSS v3.1

5.3

EPSS

Percentile

15.0

In the wild

Unconfirmed

What it is

The NS Maintenance Mode for WP WordPress plugin through 1.3.1 lacks authorization in its subscriber export function allowing unauthenticated attackers to download a list of a site's subscribers containing their name and email address

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00246 · 15.0th percentile
Published: 2025-10-22T10:15Z

References (1)

https://wpscan.com/vulnerability/1998a079-d986-47fe-907f-d4d295b06603/ · [email protected]

EPSS history

Timeline

22 OCT 06:00Z
NS Maintenance Mode for WP <= 1.3.1 - Unauthenticated Subscribers Export
cvelistv5