Arbitrary Content Injection Vulnerability in NotificationX Plugin for WordPress
CVE-2026-110721
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 16 October 2026
What is CVE-2026-110721?
The NotificationX plugin for WordPress is susceptible to a Missing Authorization vulnerability, allowing unauthenticated attackers to perform arbitrary content injection. Specifically, in versions up to 3.3.3, the plugin's REST route, /notificationx/v1/popup-submit, is configured with insufficient permission checks, enabling an attacker to exploit the nx_id parameter. This flaw permits the injection of unauthorized entries into any enabled non-popup NotificationX campaigns, such as WP Comments and WooCommerce sales. The lack of verification of campaign types leads to potential misuse and undermines the integrity of content displayed on affected sites.
Affected Version(s)
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar 0 <= 3.3.3