CVE-2022-51021: NotificationX: Unauthenticated SQL injection in REST endpoint

Summary

The NotificationX plugin for WordPress, versions 2.0.0 before 2.3.12, contains an unauthenticated SQL injection flaw in the REST route /wp-json/notificationx/v1/notification/{id}. A remote attacker can send a crafted array-form 'id' parameter together with an api_key derived from the site URL, which allows manipulation of database queries and extraction of database contents. No login is required, and the flaw is reachable from the internet on any affected site.

Affected

NotificationX (WPDeveloper) versions 2.0.0 to before 2.3.12

Fixed in

Fixed in version 2.3.12
The WordPress.org changelog lists current releases in the 3.x branch (for example 3.3.4). Compatibility of 3.x with your sites is not verified.

Workaround

Unknown.

Exploitation

CISA KEV: not listed according to the trackers checked. The CISA catalog was not checked directly.
VulnCheck's advisory index shows a VulnCheck KEV label for this CVE. This is VulnCheck's own catalog, not CISA's.
The CVE description states that the Shadowserver Foundation first observed exploitation on 2023-10-18. This was not confirmed by an independent source.
A public nuclei detection template exists. Public exploit code for this CVE is unknown.

Our recommendation

Inventory all WordPress sites and plugin versions.
Update NotificationX to the current 3.x release, testing first where possible.
Sites that cannot be updated promptly should have the plugin removed if it is not needed.
Review web server and WordPress logs for unusual requests to the notification REST endpoint, and check for database changes or new administrator accounts.
Rotate database and administrator credentials on any affected site.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Nuclei template notificationx-sqli.yaml github.com
NotificationX on WordPress.org wordpress.org
WPScan vulnerability d1480717 wpscan.com
VulnCheck advisory NotificationX 2.3.12 www.vulncheck.com
Patchstack NotificationX vulnerabilities patchstack.com
Strix CVE-2022-51021 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:00.

Original description (NVD)

NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/{id}. Attackers can pass id[1] with crafted SQL, such as time-based SLEEP payloads, along with an api_key derived from md5(home_url()), which flows unsanitized into Database::get_where_query to extract database contents. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

NVD references (4)

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed