{"id":"CVE-2026-119303","kind":"vulnerability","aliases":["CVE-2026-119303"],"related":[],"title":"NotificationX WordPress plugin: unauthenticated REST route lets anyone send emails","description":"The NotificationX  WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX  WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server.","summary":"The NotificationX WordPress plugin before 3.3.7 has a REST route with no permission or nonce check. Anyone on the internet can change a plugin option and repeatedly make the site send emails through its own mail server.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NotificationX","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["notificationx","package","wordpress"],"not_affected_if":["plugin-version-3.3.7-or-later"],"how_to_check":"- Check the installed NotificationX plugin version in the WordPress admin Plugins page; versions below `3.3.7` are in scope.","fix":"- NotificationX plugin: `3.3.7` or later (per the advisory summary).","status":"open","published_at":"2026-11-11T06:17:16+00:00","first_seen_at":"2026-11-11T06:25:41+00:00","triaged_at":"2026-11-11T06:27:36+00:00","updated_at":"2026-11-11T06:27:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T06:27:36Z","model":"claude-haiku-5-5","output":{"fix":"- NotificationX plugin: `3.3.7` or later (per the advisory summary).","reach":"internet","title":"NotificationX WordPress plugin: unauthenticated REST route lets anyone send emails","impact":"low","summary":"The NotificationX WordPress plugin before 3.3.7 has a REST route with no permission or nonce check. Anyone on the internet can change a plugin option and repeatedly make the site send emails through its own mail server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","notificationx"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Anyone can change a plugin option and trigger repeated site emails","analyst_note":"Confirm the affected REST route and option name from the NVD entry or plugin changelog; sources give no CVSS score.","how_to_check":"- Check the installed NotificationX plugin version in the WordPress admin Plugins page; versions below `3.3.7` are in scope.\n- unknown","plain_action":"","product_name":"NotificationX","needs_analyst":true,"not_affected_if":["plugin-version-3.3.7-or-later"],"who_is_affected":"WordPress sites running the NotificationX plugin before 3.3.7 are exposed, since the flawed REST route needs no login. The sources do not say which plugin settings or features must be enabled for the route to be reachable, so treat any site with the plugin installed as in scope.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4549,"output_tokens":554,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119303':13A,16A '-2026':12A,15A '3.3.7':26B,63C,88C 'allow':78C 'anyon':8A,37B 'capabl':68C 'chang':42B 'check':36B,71C 'cve':11A,14A 'email':10A,52B,94C 'internet':40B 'let':7A 'mail':56B,101C 'make':48B 'nonc':35B,70C 'notificationx':1A,17A,18B,22B,59C,84C 'one':73C 'option':45B,89C 'packag':19B 'perform':66C 'permiss':33B 'plugin':3A,24B,44B,61C,86C 'repeat':47B,92C 'rest':5A,29B,76C 'rout':6A,30B,77C 'send':9A,51B 'sent':95C 'server':57B,102C 'site':50B,98C 'trigger':93C 'unauthent':4A,79C 'updat':82C 'user':80C 'wordpress':2A,20B,23B,60C,85C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the NotificationX plugin before 3.3.7 are exposed, since the flawed REST route needs no login. The sources do not say which plugin settings or features must be enabled for the route to be reachable, so treat any site with the plugin installed as in scope.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["notificationx"],"ptokens":["notificationx"],"labels":["medium","notificationx","package","vendor","wordpress"],"campaign_type":null,"search_a":"'-119303':13A,16A '-2026':12A,15A 'anyon':8A 'cve':11A,14A 'email':10A 'let':7A 'notificationx':1A,17A 'plugin':3A 'rest':5A 'rout':6A 'send':9A 'unauthent':4A 'wordpress':2A","search_b":"'3.3.7':26B 'anyon':37B 'chang':42B 'check':36B 'email':52B 'internet':40B 'mail':56B 'make':48B 'nonc':35B 'notificationx':18B,22B 'option':45B 'packag':19B 'permiss':33B 'plugin':24B,44B 'repeat':47B 'rest':29B 'rout':30B 'send':51B 'server':57B 'site':50B 'wordpress':20B,23B","search_c":"'3.3.7':63C,88C 'allow':78C 'capabl':68C 'check':71C 'email':94C 'mail':101C 'nonc':70C 'notificationx':59C,84C 'one':73C 'option':89C 'perform':66C 'plugin':61C,86C 'repeat':92C 'rest':76C 'rout':77C 'sent':95C 'server':102C 'site':98C 'trigger':93C 'unauthent':79C 'updat':82C 'user':80C 'wordpress':60C,85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119303","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119303","severity":null,"published_at":"2026-11-11T06:17:16+00:00","modified_at":"2026-11-11T06:17:16+00:00","first_seen_at":"2026-11-11T06:25:41+00:00","fetched_at":"2026-11-11T06:25:41+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}