Read the docs
TI-2022-26709 Aliases CVE-2022-51021GHSA-ch24-62hg-vfpg

Unauthenticated SQL injection in NotificationX WordPress plugin

Priority MEDIUM 44CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

WPDeveloper NotificationX plugin for WordPress from 2.0.0 before 2.3.12 is affected. The REST endpoint passes an array-form id parameter into database queries without sanitization, which is an SQL injection flaw (CWE-89). An unauthenticated remote attacker can manipulate database queries and extract database contents. The Shadowserver Foundation first observed exploitation on 2023-10-18.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/{id}. Attackers can pass id[1] with crafted SQL, such as time-based SLEEP payloads, along with an api_key derived from md5(home_url()), which flows unsanitized into Database::get_where_query to extract database contents. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00461 40th percentileScored 2026-11-07
Fix Fixed NotificationX (WPDeveloper): 2.3.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wpdevteamNotificationX2.0.0 to before 2.3.122.3.12Patch availableCNA
  • NotificationX Vendorwpdevteam Affected 2.0.0 to before 2.3.12 Fixed in 2.3.12 Patch available CNA

Remediation

Upgrade WPDeveloper NotificationX to version 2.3.12, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA NotificationX (WPDeveloper) Fixed in 2.3.12

Timeline

  1. 2026-10-22 Threatist record created from CVE-2022-51021
  2. 2026-10-22 Alias added: GHSA-ch24-62hg-vfpg
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-10-23 CISA SSVC decision points changed
  5. 2026-10-24 Priority changed: LOW → MEDIUM

References

Advisory 1

Other 2

  • TI-2024-01579 SQL injection in wpdevteam NotificationX – FOMO, Live Sales Notification, WooCommerce… CVSS 3.1CRITICAL 9.8
  • TI-2023-15541 WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation CVSS 3.1CRITICAL 9.8
  • TI-2023-06070 Essential Blocks < 4.4.3 - Unauthenticated Local File Inclusion CVSS 3.1CRITICAL 9.8
  • TI-2023-11478 SQL injection in ReviewX WordPress Plugin CVSS 3.1HIGH 8.8
  • TI-2022-00275 NotificationX < 2.3.9 - Unauthenticated Blind SQL Injection CVSS 3.1CRITICAL 9.8
  • TI-2024-05197 Essential Blocks < 4.7.0 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
See all 209 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences