Vulnerabilities / NotificationX / WPSEC-2026-1010
NotificationX <= 3.3.3 - Unauthenticated Missing Authorization to Notification Entry Injection via popup-submit REST Endpoint
Medium 5.3
CWE-862Fixed in 3.3.4
- ID
- WPSEC-2026-1010
- Plugin
- NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar (notificationx)
- Affected
- from 3.2.7 before 3.3.4
- Remediation
- Update to 3.3.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-15
- Attack surface
- NotificationX on WPSec AttackSurface
- Fix released
- Published
Description
The NotificationX plugin for WordPress is vulnerable to unauthorized notification entry injection via the popup-submit REST endpoint in versions 3.2.7 up to, and including, 3.3.3, due to the endpoint accepting entries for any notification ID and storing them under that notification's own source instead of limiting submissions to popup and exit-intent form notifications. This makes it possible for unauthenticated attackers to add fabricated entries, such as fake sales or reviews, to other notifications that are displayed to site visitors.
References
- https://wpsec.com/vuln/WPSEC-2026-1010/
- https://plugins.svn.wordpress.org/notificationx/tags/3.3.4/
- https://wordpress.org/plugins/notificationx/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS