CVE-2026-119302: NotificationX < 3.3.7 - Unauthenticated Non-Public Content Disclosure and Arbitrary Shortcode Execution via Notification Preview

Q: Which installations are exposed?

WordPress sites using WPDeveloper NotificationX versions earlier than 3.3.7 are affected. The vulnerable preview path can be reached through any front-end request.

Q: What does an attacker need to exploit this issue?

No authentication, WordPress capability, nonce, or user interaction is required. An attacker can supply crafted notification preview data remotely.

Q: What could an attacker access or execute?

An attacker may disclose content from private, draft, pending, and password-protected posts. They can also execute arbitrary shortcodes that are registered on the affected site.

Q: How can I determine whether my site is affected?

Check the installed NotificationX plugin version. Versions before 3.3.7 are affected; version 3.3.7 is the stated fixed version.

Published Nov 11, 2026

Updated

The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered shortcodes by supplying crafted preview data on any front-end request.

Affected Software

1 affected component

WPDeveloper NotificationX<3.3.7

Event History

Nov 11, 2026

CVE Published

via MITRE·07:33 AM

Data Sourced

via MITRE·07:33 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are exposed?

WordPress sites using WPDeveloper NotificationX versions earlier than 3.3.7 are affected. The vulnerable preview path can be reached through any front-end request.

What does an attacker need to exploit this issue?

No authentication, WordPress capability, nonce, or user interaction is required. An attacker can supply crafted notification preview data remotely.

What could an attacker access or execute?

An attacker may disclose content from private, draft, pending, and password-protected posts. They can also execute arbitrary shortcodes that are registered on the affected site.

How can I determine whether my site is affected?

Check the installed NotificationX plugin version. Versions before 3.3.7 are affected; version 3.3.7 is the stated fixed version.

CVE-2026-119302: NotificationX < 3.3.7 - Unauthenticated Non-Public Content Disclosure and Arbitrary Shortcode Execution via Notification Preview

Affected Software

Event History

Frequently Asked Questions

Which installations are exposed?

What does an attacker need to exploit this issue?

What could an attacker access or execute?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Which installations are exposed?

What does an attacker need to exploit this issue?

What could an attacker access or execute?

How can I determine whether my site is affected?