CVE-2026-119302 · Package
NO FIX YET · SEE WHAT TO DO
The NotificationX WordPress plugin before 3.3.7 skips permission and nonce checks on its notification preview path. An unauthenticated visitor can read private, draft, pending and password-protected posts and run registered shortcodes.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any WordPress site running the NotificationX plugin before 3.3.7 is exposed to a request on any front-end page, with no login needed. Sites that do not have NotificationX installed can skip it.
Not affected if plugin-3.3.7-or-later, plugin-not-installed
Who cares notificationx, self-hosted, wordpress
wp plugin get notificationx --field=version3.3.7The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered shortcodes by supplying crafted preview data on any front-end request.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.