{"id":"CVE-2026-119302","kind":"vulnerability","aliases":["CVE-2026-119302"],"related":[],"title":"NotificationX WordPress plugin: unauthenticated users can read private and draft posts","description":"The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered shortcodes by supplying crafted preview data on any front-end request.","summary":"The NotificationX WordPress plugin before 3.3.7 skips permission and nonce checks on its notification preview path. An unauthenticated visitor can read private, draft, pending and password-protected posts and run registered shortcodes.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["notificationx","package","self-hosted","wordpress"],"not_affected_if":["plugin-3.3.7-or-later","plugin-not-installed"],"how_to_check":"- Check the installed NotificationX plugin version in the WordPress admin under Plugins, or with `wp plugin get notificationx --field=version`","fix":"- NotificationX WordPress plugin: `3.3.7`","status":"open","published_at":"2026-11-11T08:17:17+00:00","first_seen_at":"2026-11-11T08:26:05+00:00","triaged_at":"2026-11-11T08:27:55+00:00","updated_at":"2026-11-11T08:27:55+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T08:27:55Z","model":"claude-haiku-5-5","output":{"fix":"- NotificationX WordPress plugin: `3.3.7`","reach":"internet","title":"NotificationX WordPress plugin: unauthenticated users can read private and draft posts","impact":"medium","summary":"The NotificationX WordPress plugin before 3.3.7 skips permission and nonce checks on its notification preview path. An unauthenticated visitor can read private, draft, pending and password-protected posts and run registered shortcodes.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","notificationx","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated visitors read private posts and run shortcodes","analyst_note":"","how_to_check":"- Check the installed NotificationX plugin version in the WordPress admin under Plugins, or with `wp plugin get notificationx --field=version`\n- unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-3.3.7-or-later"],"who_is_affected":"Any WordPress site running the NotificationX plugin before 3.3.7 is exposed to a request on any front-end page, with no login needed. Sites that do not have NotificationX installed can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":4564,"output_tokens":482,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119302':14A,17A '-2026':13A,16A '3.3.7':29B,62C 'allow':77C 'arbitrari':96C 'authent':68C 'capabl':67C 'check':34B,71C 'content':83C 'craft':101C 'cve':12A,15A 'data':103C 'disclos':81C 'draft':10A,46B,86C 'end':108C 'execut':95C 'front':107C 'front-end':106C 'host':22B 'nonc':33B,70C 'notif':37B,74C 'notificationx':1A,18B,25B,58C 'packag':19B 'password':50B,90C 'password-protect':49B,89C 'path':39B,76C 'pend':47B,87C 'perform':65C 'permiss':31B 'plugin':3A,27B,60C 'post':11A,52B,92C 'preview':38B,75C,102C 'privat':8A,45B,85C 'protect':51B,91C 'read':7A,44B 'regist':55B,97C 'request':109C 'run':54B 'self':21B 'self-host':20B 'shortcod':56B,98C 'skip':30B 'suppli':100C 'unauthent':4A,41B,78C 'user':5A,79C 'visitor':42B 'wordpress':2A,23B,26B,59C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the NotificationX plugin before 3.3.7 is exposed to a request on any front-end page, with no login needed. Sites that do not have NotificationX installed can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","notificationx","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-119302':14A,17A '-2026':13A,16A 'cve':12A,15A 'draft':10A 'notificationx':1A 'plugin':3A 'post':11A 'privat':8A 'read':7A 'unauthent':4A 'user':5A 'wordpress':2A","search_b":"'3.3.7':29B 'check':34B 'draft':46B 'host':22B 'nonc':33B 'notif':37B 'notificationx':18B,25B 'packag':19B 'password':50B 'password-protect':49B 'path':39B 'pend':47B 'permiss':31B 'plugin':27B 'post':52B 'preview':38B 'privat':45B 'protect':51B 'read':44B 'regist':55B 'run':54B 'self':21B 'self-host':20B 'shortcod':56B 'skip':30B 'unauthent':41B 'visitor':42B 'wordpress':23B,26B","search_c":"'3.3.7':62C 'allow':77C 'arbitrari':96C 'authent':68C 'capabl':67C 'check':71C 'content':83C 'craft':101C 'data':103C 'disclos':81C 'draft':86C 'end':108C 'execut':95C 'front':107C 'front-end':106C 'nonc':70C 'notif':74C 'notificationx':58C 'password':90C 'password-protect':89C 'path':76C 'pend':87C 'perform':65C 'plugin':60C 'post':92C 'preview':75C,102C 'privat':85C 'protect':91C 'regist':97C 'request':109C 'shortcod':98C 'suppli':100C 'unauthent':78C 'user':79C 'wordpress':59C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T08:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119302","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119302","severity":null,"published_at":"2026-11-11T08:17:17+00:00","modified_at":"2026-11-11T08:17:17+00:00","first_seen_at":"2026-11-11T08:26:05+00:00","fetched_at":"2026-11-11T08:26:05+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}