CVE-2026-119303 | BDVDB-2026-404795 Detail

NotificationX

Description#

The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-862 Missing Authorization

References#

https://wpscan.com/vulnerability/0280952e-f388-44a3-a891-5855580a5f5b/

Exploit#

https://wpscan.com/vulnerability/0280952e-f388-44a3-a891-5855580a5f5b/

History#

Version 12026-11-11Record published in the CVE List.