NotificationX WordPress plugin: Missing authorization in REST route
Summary
The NotificationX WordPress plugin before 3.3.7 lacks capability and nonce checks on one of its REST routes. An unauthenticated attacker can change a plugin option and repeatedly trigger emails sent through the site's own mail server. The impact on confidentiality is limited, but the abuse can lead to spam complaints and blacklisting of the company mail domain.
Affected
- NotificationX WordPress plugin versions before 3.3.7 (per CNA; lower bound not confirmed)
- Exact option name and REST route: Unknown.
Fixed in
- Version 3.3.7
Workaround
- No vendor or CNA workaround known.
- Interim measure (own suggestion): deactivate NotificationX until the upgrade is possible if the upgrade is delayed.
Exploitation
- No public exploit or evidence of active exploitation known at time of research.
- Not listed in CISA KEV at time of research.
- Exploitation requires no account; the flaw is remotely reachable on internet-facing WordPress sites.
Our recommendation
- Upgrade all NotificationX installations to version 3.3.7 or later, prioritising internet-facing sites.
- Check the plugin version across all WordPress sites.
- Review mail logs for unusual volumes of notification emails.
- Re-check the NVD score once published; VulDB rates the CVE 6.5, the CNA 5.3.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability record wpscan.com
- VulDB CVE-2026-119303 vuldb.com
- Patchstack NotificationX vulnerabilities patchstack.com
- OffSeq threat entry CVE-2026-119303 radar.offseq.com
- OpenCVE CVE-2026-119303 app.opencve.io
- VulDB CVE-2026-119302 (related) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:05.
Original description (NVD)
The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.