CVE-2026-110721: NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route

Q: Who can exploit this issue?

Any unauthenticated remote attacker can submit requests to the affected REST route. No WordPress account, privileges, or user interaction are required.

Q: Which NotificationX campaigns are at risk of receiving forged entries?

Enabled non-popup NotificationX campaigns may be targeted, including WP Comments, WooCommerce, Easy Digital Downloads, Give sales, and review campaigns. The attacker supplies an nx_id identifying the campaign to receive the injected entry.

Q: What can an attacker inject?

An attacker can create forged social-proof entries containing a name, title, message, email address, and theme. The issue affects integrity only; the provided severity vector indicates no confidentiality or availability impact.

Q: How can I determine whether my site may already be affected?

Review entries associated with enabled non-popup NotificationX campaigns for unexpected social-proof records, particularly entries with suspicious names, titles, messages, or email addresses. Also review access logs for unauthenticated requests to the /notificationx/v1/popup-submit REST route.

Published Oct 16, 2026

Updated

The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permissioncallback => 'returntrue', and the handler at PopupNotification::handlepopupsubmission() accepts an attacker-controlled nxid, loads whichever NotificationX campaign that id points to, and copies that campaign's own source into the new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup (the two sources this form is intended to serve). This makes it possible for unauthenticated attackers to inject forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign — WP Comments, WooCommerce/EDD/Give sales, reviews, etc.

Affected Software

1 affected component

NotificationX NotificationX<=3.3.3

Event History

Oct 16, 2026

CVE Published

via MITRE·04:27 AM

Data Sourced

via MITRE·04:27 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote attacker can submit requests to the affected REST route. No WordPress account, privileges, or user interaction are required.

Which NotificationX campaigns are at risk of receiving forged entries?

Enabled non-popup NotificationX campaigns may be targeted, including WP Comments, WooCommerce, Easy Digital Downloads, Give sales, and review campaigns. The attacker supplies an nx_id identifying the campaign to receive the injected entry.

What can an attacker inject?

An attacker can create forged social-proof entries containing a name, title, message, email address, and theme. The issue affects integrity only; the provided severity vector indicates no confidentiality or availability impact.

How can I determine whether my site may already be affected?

Review entries associated with enabled non-popup NotificationX campaigns for unexpected social-proof records, particularly entries with suspicious names, titles, messages, or email addresses. Also review access logs for unauthenticated requests to the /notificationx/v1/popup-submit REST route.

CVE-2026-110721: NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which NotificationX campaigns are at risk of receiving forged entries?

What can an attacker inject?

How can I determine whether my site may already be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which NotificationX campaigns are at risk of receiving forged entries?

What can an attacker inject?

How can I determine whether my site may already be affected?