{
 "id": "WPSEC-2026-1010",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1010/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1010/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1010/index.md",
 "title": "NotificationX <= 3.3.3 - Unauthenticated Missing Authorization to Notification Entry Injection via popup-submit REST Endpoint",
 "description": "The NotificationX plugin for WordPress is vulnerable to unauthorized notification entry injection via the popup-submit REST endpoint in versions 3.2.7 up to, and including, 3.3.3, due to the endpoint accepting entries for any notification ID and storing them under that notification's own source instead of limiting submissions to popup and exit-intent form notifications. This makes it possible for unauthenticated attackers to add fabricated entries, such as fake sales or reviews, to other notifications that are displayed to site visitors.",
 "plugin": {
  "slug": "notificationx",
  "name": "NotificationX",
  "full_name": "NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar",
  "wordpress_org": "https://wordpress.org/plugins/notificationx/",
  "advisories_url": "https://wpsec.com/vuln/plugin/notificationx/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/notificationx"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.2.7",
    "from_inclusive": true,
    "to": "3.3.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.2.7 before 3.3.4"
  ]
 },
 "introduced_in": "3.2.7",
 "fixed_in": "3.3.4",
 "remediation": "Update to 3.3.4 or later.",
 "fix_released": "2026-10-14T12:01:06+00:00",
 "published": "2026-10-15T12:51:52+00:00",
 "updated": "2026-10-14T19:50:02.992223+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1010/",
  "https://plugins.svn.wordpress.org/notificationx/tags/3.3.4/",
  "https://wordpress.org/plugins/notificationx/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/notificationx",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-15"
 }
}