{"schema":"threatline.record/2","record":{"id":"CVE-2026-110721","aliases":[],"summary":"NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route","details":"The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permission_callback => '__return_true', and the handler at PopupNotification::handle_popup_submission() accepts an attacker-controlled nx_id, loads whichever NotificationX campaign that id points to, and copies that campaign's own source into the new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup (the two sources this form is intended to serve). This makes it possible for unauthenticated attackers to inject forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign — WP Comments, WooCommerce/EDD/Give sales, reviews, etc.","categories":["Unclassified"],"product":"NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar","vendor":"wpdevteam","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110721","source_modified_at":"2026-10-16T15:09:39.990Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar","vendor":"wpdevteam","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.3","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00245,"percentile":0.14856,"score_date":"2026-10-23"},"published_at":"2026-10-16T04:27:00.768Z","modified_at":"2026-10-16T15:09:39.990Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-110721","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-16T15:09:39.990Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110721","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84b5e044-4522-480a-ad14-8886ed691a86?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/PopupNotification/PopupNotification.php#L1161"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/Extension.php#L668"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Core/Rest/Popup.php#L58"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Core/Rest/Popup.php#L186"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Admin/Entries.php#L93"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset/3746251/notificationx/trunk/includes/Extensions/PopupNotification/PopupNotification.php"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-16T14:56:40.516470Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-16T15:09:39.990Z","content_hash":"b31cb6352079acdb36799f65da449ae6b5ff8e6cdcb91240ee085e2b40f797d3"}}