NotificationX CVE-2026-110721

Exploitable only when at least one non-popup NotificationX campaign (WP Comments, WooCommerce/EDD/Give sales, reviews, etc.) is created and enabled on the target site, since the injected entry is written into an existing campaign referenced by the attacker-supplied nx_id. No authentication, user interaction, or non-default configuration of the plugin is required - the vulnerable /notificationx/v1/popup-submit route ships with permission_callback => '__return_true' in versions up to and including 3.3.3. The limiting factor is impact scope, not access: injected content only affects displayed social-proof notifications (name/title/message/email/theme) and cannot alter site code, credentials, or availability.

This is a genuine-but-moderate issue, correctly scored CVSS 5.3 (Medium). The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N is internally consistent with the description: the /notificationx/v1/popup-submit REST route is registered with permission_callback => '__return_true', confirming no-privilege (PR:N), no-interaction (UI:N), low-complexity (AC:L) remote (AV:N) reach. Impact is correctly limited to integrity (I:L) with no confidentiality or availability effect - the flaw injects forged social-proof entries, not code or data exfiltration, so this is not an RCE-class emergency despite being trivially reachable. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation pressure signals are absent: no public exploit identified at time of analysis. The practical ceiling is reputational/social-engineering abuse (fake sales, reviews, comment counts) rather than system compromise, which is why the real-world priority is lower than the 'unauthenticated + low-complexity' framing alone might suggest. No signals conflict; the main limitation is simply that integrity impact is bounded to displayed notification content.

An unauthenticated attacker sends a crafted POST request to the public /notificationx/v1/popup-submit REST endpoint supplying an nx_id that points to a non-popup campaign (e.g. a WooCommerce sales or WP Comments NotificationX). Because the handler never verifies the campaign type or the caller's authorization, the attacker's forged name, title, message, email, and theme are copied into that live campaign and displayed to real site visitors as legitimate social proof. No public exploit code was identified at time of analysis, but exploitation requires only a standard HTTP client.