---
id: "CVE-2026-110721"
kind: "vulnerability"
aliases: ["CVE-2026-110721"]
title: "NotificationX WordPress plugin: unauthenticated users can inject fake social-proof entries"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["notificationx", "other", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["only-popup-campaigns", "plugin-above-3.3.3", "plugin-not-installed"]
published_at: "2026-10-16T05:17:30+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:28:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110721", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# NotificationX WordPress plugin: unauthenticated users can inject fake social-proof entries

NotificationX up to and including 3.3.3 registers the REST route /notificationx/v1/popup-submit with no permission check, so anyone can call it. An attacker can use it to add forged names, titles, messages and emails to any enabled non-popup campaign, such as WP Comments or WooCommerce sales.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `wp plugin get notificationx --field=version` or the Plugins screen; versions `3.3.3` and older are affected.
- Request `/wp-json/notificationx/v1/popup-submit` without logging in and see whether the route responds.
- Review NotificationX campaigns for enabled non-popup sources (WP Comments, WooCommerce, EDD, Give, reviews).

## Fix

- Update NotificationX to a release newer than `3.3.3`.
- Until updated, deactivate the plugin or disable non-popup NotificationX campaigns.
- Remove any forged entries already shown on the site.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110721

## From the sources

The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permission_callback => '__return_true', and the handler at PopupNotification::handle_popup_submission() accepts an attacker-controlled nx_id, loads whichever NotificationX campaign that id points to, and copies that campaign's own source into the new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup (the two sources this form is intended to serve). This makes it possible for unauthenticated attackers to inject forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign — WP Comments, WooCommerce/EDD/Give sales, reviews, etc.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_