Unauthenticated SQL Injection in NotificationX Plugin for WordPress

CVE-2022-51021

What is CVE-2022-51021?

The NotificationX plugin for WordPress versions prior to 2.3.12 is susceptible to an unauthenticated SQL injection vulnerability. This issue allows remote attackers to manipulate database queries by providing a specially crafted 'id' parameter in the REST API endpoint. By exploiting this vulnerability, attackers can inject malicious SQL commands, such as time-based SLEEP payloads, which could lead to unauthorized access to sensitive database information. Unsanitized parameters flow directly into the database query execution, making it critical for users to apply updates to protect against potential exploits.

References