Vulnerability feed

Executive summary

The NotificationX plugin for WordPress, in versions 2.0.0 before 2.3.12, contains an SQL injection flaw that the advisory says can be exploited without logging in. The advisory states the fix is in version 2.3.12, and the excerpt does not give a severity score from the publisher, though a related template labels it high.

Technical summary

This is an SQL injection flaw (CWE-89) in the notificationx/v1/notification REST endpoint, where the id parameter is used in a SQL statement without validation or escaping. The advisory says it is unauthenticated, and the proof-of-concept uses a time-based payload with SLEEP to confirm the injection, with a response check for status 401 and a JSON message. Affected versions are stated as 2.0.0 before 2.3.12, and the fixed version is 2.3.12. Workarounds are not stated. Exploitation in the wild and a CVSS score are not stated. Detection guidance is limited to the included time-based test request against /wp-json/notificationx/v1/notification/1 with a delayed response.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/projectdiscovery/nuclei-temp…ificationx-sqli.yaml

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

None

Privileges required

None

User interaction

None

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

WPDeveloperWordPressNotificationXWPDeveloper NotificationXWordPressNotificationX