NotificationX <= 3.3.6 - Unauthenticated Sensitive Information Exposure and Arbitrary Shortcode Execution via Preview Mode
- ID
- WPSEC-2026-2205
- Plugin
- NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar (notificationx)
- Affected
- all versions before 3.3.7
- Remediation
- Update to 3.3.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- NotificationX on WPSec AttackSurface
- Fix released
- Published
Description
The NotificationX plugin for WordPress is vulnerable to Sensitive Information Exposure and Arbitrary Shortcode Execution via the 'nx-preview' preview mode in all versions up to, and including, 3.3.6. This is due to missing authorization and nonce checks on requests that carry an 'nx-preview' payload. The base64-encoded JSON settings in that payload are used as notification bar settings and rendered into the front-end page, and bar content is rendered from any post ID without checking its type, status or password. This makes it possible for unauthenticated attackers to read the content of draft, private or password-protected posts by referencing their IDs, and to execute arbitrary shortcodes supplied in the request.
References
- https://wpsec.com/vuln/WPSEC-2026-2205/
- https://plugins.svn.wordpress.org/notificationx/tags/3.3.7/
- https://wordpress.org/plugins/notificationx/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS