CVE-2026-110721: NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route
The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permissioncallback => 'returntrue', and the handler at PopupNotification::handlepopupsubmission() accepts an attacker-controlled nxid, loads whichever NotificationX campaign that id points to, and copies that campaign's own source into the new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup (the two sources this form is intended to serve). This makes it possible for unauthenticated attackers to inject forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign — WP Comments, WooCommerce/EDD/Give sales, reviews, etc.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can submit requests to the affected REST route. No WordPress account, privileges, or user interaction are required.
Which NotificationX campaigns are at risk of receiving forged entries?
Enabled non-popup NotificationX campaigns may be targeted, including WP Comments, WooCommerce, Easy Digital Downloads, Give sales, and review campaigns. The attacker supplies an nx_id identifying the campaign to receive the injected entry.
What can an attacker inject?
An attacker can create forged social-proof entries containing a name, title, message, email address, and theme. The issue affects integrity only; the provided severity vector indicates no confidentiality or availability impact.
How can I determine whether my site may already be affected?
Review entries associated with enabled non-popup NotificationX campaigns for unexpected social-proof records, particularly entries with suspicious names, titles, messages, or email addresses. Also review access logs for unauthenticated requests to the /notificationx/v1/popup-submit REST route.