The flaw is an unauthenticated SQL injection in the NotificationX WordPress plugin that allows a remote attacker to inject arbitrary SQL code by supplying an array‑style 'id' parameter to the REST endpoint /wp-json/notificationx/v1/notification/{id}. The supplied payload is concatenated directly into a database query via Database::get_where_query without proper sanitization, letting the attacker read sensitive information or modify table contents. The compromised data can include user credentials, content, and configuration settings, which may be leveraged for further exploitation of the WordPress site.

WPDeveloper’s NotificationX plugin for WordPress, versions from 2.0.0 through 2.3.11, is affected. Any WordPress installation that has the plugin installed and exposes the /wp-json/notificationx/v1/notification/{id} endpoint is vulnerable. The vulnerability exists across all sub‑versions of the plugin released prior to version 2.3.12.

The flaw is assigned a CVSS score of 8.8, indicating high severity. The EPSS score is not available, so the exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Because the endpoint is accessible without authentication, an attacker can trigger the injection from any external IP that can reach the site. Time‑based payloads such as SLEEP can be used to confirm and extract data, confirming the presence of the flaw via response latency.