Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110721— NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route

Quick assessment

Affected
wpdevteam NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 NotificationX 插件存在“缺少授权”漏洞，可能导致任意内容注入，受影响版本为 3.3.3 及以下。该插件注册的 REST 路由将 参数设置为 ，而处理函数 会接受攻击者控制的 参数，加载该 ID 指向的任意 NotificationX 活动，并在未验证该活动是否为“弹窗通知”或“退出意图弹窗”（即该表单本应服务的两种类型）的情况下，直接将活动的原始内容复制到新条目中。这使得未认证的攻击者能够向任何已启用的非弹窗类 NotificationX 活动（例如 WordPress 评论、

CVSS 5.3 · Medium EPSS 0.24% · P15
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110721

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route
Source: CVE Program / CVE List V5
Vulnerability Description
The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permission_callback => '__return_true', and the handler at PopupNotification::handle_popup_submission() accepts an attacker-controlled nx_id, loads whichever NotificationX campaign that id points to, and copies that campaign's own source into the new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup (the two sources this form is intended to serve). This makes it possible for unauthenticated attackers to inject forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign — WP Comments, WooCommerce/EDD/Give sales, reviews, etc.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
wpdevteam NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar 0 ~ 3.3.3 -

II. Public POCs for CVE-2026-110721

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110721

请登录查看更多情报信息。

Proof of Concept for CVE-2026-110721 (1)

Vendor Pages for CVE-2026-110721 (1)

Other References for CVE-2026-110721 (1)

IV. Related Vulnerabilities

Same product: NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
Same vendor: wpdevteam
Same weakness: CWE-862

V. Comments for CVE-2026-110721

No comments yet

Leave a comment