---
id: "CVE-2026-119302"
page: "https://infrastack.ai/live/CVE-2026-119302"
kind: "vulnerability"
aliases: ["CVE-2026-119302"]
title: "NotificationX WordPress plugin: unauthenticated users can read private and draft posts"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["notificationx", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-3.3.7-or-later", "plugin-not-installed"]
published_at: "2026-11-11T08:17:17+00:00"
first_seen_at: "2026-11-11T08:26:05+00:00"
updated_at: "2026-11-11T08:27:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119302", "first_seen_at": "2026-11-11T08:26:05+00:00"}]
exploit_sources: []
---

# NotificationX WordPress plugin: unauthenticated users can read private and draft posts

Link for people: https://infrastack.ai/live/CVE-2026-119302 (this .md is for agents)

The NotificationX WordPress plugin before 3.3.7 skips permission and nonce checks on its notification preview path. An unauthenticated visitor can read private, draft, pending and password-protected posts and run registered shortcodes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed NotificationX plugin version in the WordPress admin under Plugins, or with `wp plugin get notificationx --field=version`

## Fix

- NotificationX WordPress plugin: `3.3.7`

## Timeline

- 2026-11-11T08:26:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119302

## From the sources

The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered shortcodes by supplying crafted preview data on any front-end request.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_