CVE-2026-119303: NotificationX < 3.3.7 - Unauthenticated Settings Update and Email Sending via send-rating REST Route

Q: Who can exploit this issue?

Any unauthenticated remote user can exploit the affected REST route. No WordPress account, capability, or nonce is required.

Q: What impact should administrators expect?

An attacker can update a NotificationX plugin option and repeatedly cause emails to be sent through the site's configured mail server. This can be abused to generate unwanted outbound email from the site.

Q: Which installations are affected?

NotificationX versions before 3.3.7 are affected. The issue is exposed through a REST route that lacks both capability and nonce checks.

Q: What can be done if upgrading is not immediately possible?

The provided information does not identify a workaround. Administrators should prioritize preventing unauthenticated access to the vulnerable REST route and monitor site mail activity for repeated unexpected messages.

Published Nov 11, 2026

Updated

The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server.

Affected Software

1 affected component

NotificationX NotificationX WordPress plugin<3.3.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade NotificationX WordPress plugin to a version that resolves this vulnerability.
Fixed in 3.3.7

Event History

Nov 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote user can exploit the affected REST route. No WordPress account, capability, or nonce is required.

What impact should administrators expect?

An attacker can update a NotificationX plugin option and repeatedly cause emails to be sent through the site's configured mail server. This can be abused to generate unwanted outbound email from the site.

Which installations are affected?

NotificationX versions before 3.3.7 are affected. The issue is exposed through a REST route that lacks both capability and nonce checks.

What can be done if upgrading is not immediately possible?

The provided information does not identify a workaround. Administrators should prioritize preventing unauthenticated access to the vulnerable REST route and monitor site mail activity for repeated unexpected messages.

CVE-2026-119303: NotificationX < 3.3.7 - Unauthenticated Settings Update and Email Sending via send-rating REST Route

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What impact should administrators expect?

Which installations are affected?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What impact should administrators expect?

Which installations are affected?

What can be done if upgrading is not immediately possible?