# NotificationX <= 3.3.3 - Unauthenticated Missing Authorization to Notification Entry Injection via popup-submit REST Endpoint

- **ID:** WPSEC-2026-1010
- **Plugin:** NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar (`notificationx`), https://wordpress.org/plugins/notificationx/
- **Affected versions:** from 3.2.7 before 3.3.4
- **Fixed in:** 3.3.4 (Update to 3.3.4 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/notificationx
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1010/

## Description

The NotificationX plugin for WordPress is vulnerable to unauthorized notification entry injection via the popup-submit REST endpoint in versions 3.2.7 up to, and including, 3.3.3, due to the endpoint accepting entries for any notification ID and storing them under that notification's own source instead of limiting submissions to popup and exit-intent form notifications. This makes it possible for unauthenticated attackers to add fabricated entries, such as fake sales or reviews, to other notifications that are displayed to site visitors.

## References

- https://wpsec.com/vuln/WPSEC-2026-1010/
- https://plugins.svn.wordpress.org/notificationx/tags/3.3.4/
- https://wordpress.org/plugins/notificationx/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1010/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.