Description
The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | NotificationX | < 3.3.7 | 3.3.7 |
References
- https://wpscan.com/vulnerability/0280952e-f388-44a3-a891-5855580a5f5b/ exploit vdb-entry technical-description