NotificationX WordPress Plugin CVE-2024-1698

No special conditions - remote unauthenticated exploitation against default configurations of any WordPress site running NotificationX plugin version 2.8.2 or earlier with the plugin activated. The vulnerable 'type' parameter is reachable over the network without authentication or user interaction (CVSS AV:N/AC:L/PR:N/UI:N). The only practical limiter is that the NotificationX plugin must be installed and active; sites that have it deactivated or removed are not exposed via this code path.

Risk is very high and warrants priority remediation. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction, scoring 9.8 critical. EPSS at 93.74% (100th percentile) signals one of the most likely-to-be-exploited CVEs tracked, and a public PoC is available, lowering the skill barrier significantly. The vulnerability is not currently in CISA KEV, so confirmed in-the-wild exploitation against U.S. federal targets has not been catalogued; however, the combination of unauthenticated SQLi in a widely deployed WordPress plugin, a public exploit, and very high EPSS strongly suggests opportunistic mass exploitation is plausible. No conflicting signals were identified across the data sources.

An unauthenticated attacker scans WordPress sites for NotificationX <=2.8.2, then issues an HTTP request to the vulnerable endpoint with a malicious 'type' parameter that appends a UNION SELECT or stacked query to the existing SQL statement. Using the publicly available exploit, the attacker extracts wp_users password hashes, secret_keys, and session tokens from the database, enabling offline cracking or session hijacking to escalate to administrative access on the WordPress site.