Security Alert Summary
NotificationX for WordPress contains an unauthenticated SQL injection vulnerability in its REST endpoint that can allow remote attackers to manipulate database queries by supplying an array-form id parameter. The issue can be triggered without credentials and has been observed in exploitation attempts that include time-based payloads.
CVE Details
- CVE ID:
CVE-2022-51021 - Affected component: NotificationX plugin for WordPress
- Affected versions: 2.0.0 before 2.3.12
- Published: October 22, 2026 at 11:17:04 AM
- Last modified: October 22, 2026 at 11:17:04 AM
- CVSS v3.1: Base score 8.2, Severity HIGH; Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- Authentication / privileges / user interaction: No authentication required; privileges required: none; user interaction: none
- Primary impact: Confidentiality: High; Integrity: Low; Availability: None
- CWE: CWE-89 (SQL Injection)
Technical Details
The vulnerability is an unauthenticated SQL injection in the NotificationX REST endpoint /wp-json/notificationx/v1/notification/{id}. Attackers can supply an array-form id parameter (for example id[1]) containing crafted SQL payloads, including time-based SLEEP expressions. The request also supplies an api_key derived from md5(home_url()), and the supplied values flow unsanitized into Database::get_where_query, allowing manipulation of the constructed database query and extraction of database contents.
This weakness exists because input from the REST endpoint is not properly validated or sanitized before being used to build the SQL query. The observable impact reported includes attempts to execute time-based SQL payloads.
How This Could Impact Your Website
On a multi-user WordPress site, an external attacker could exploit this issue without logging in. For example, an attacker targeting a site might extract user-related database rows that include email addresses or other stored data. That information could then be used to launch targeted phishing or social engineering campaigns against the site owner, staff, or external contributors.
Practical consequences include exposure of internal user email addresses and increased risk of targeted phishing. The vulnerability does not, based on the provided data, imply automatic full site compromise, but it does raise a realistic risk to stored confidential data.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, such as unexpected REST requests or database query patterns.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/notificationx-sqli.yaml
- https://wordpress.org/plugins/notificationx/
- https://wpscan.com/vulnerability/d1480717-726d-4be2-95cb-1007a3f010bb
- https://www.vulncheck.com/advisories/notificationx-wordpress-plugin-2.3.12-unauthenticated-sql-injection-via-notification-rest-endpoint
