The NotificationX WordPress plugin registers a REST endpoint /notificationx/v1/popup-submit that accepts an nx_id parameter. The endpoint’s permission_callback returns true, so any user can execute the handler without authentication. The handler loads the campaign identified by nx_id and copies its source data directly into a new entry, assuming it is a Popup or Exit Intent Popup. This allows an unauthenticated attacker to inject arbitrary content (such as name, title, message, email, theme) into any non‑popup NotificationX campaign, including WooCommerce sales, reviews, and comment notifications. The flaw is a Missing Authorization weakness (CWE-862), whereby the REST route does not enforce proper access controls before performing the content injection.

WordPress installations that have NotificationX plugin version 3.3.3 or earlier. The affected features are the FOMO banners, live sales notifications, WooCommerce sales popups, GDPR notices, social proof displays, announcement banners, and floating notification bars.

The published CVSS score of 5.3 indicates moderate severity. The EPSS score is reported as less than 1%, suggesting very low but non‑zero exploitation probability at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by issuing unauthenticated POST requests to the /notificationx/v1/popup-submit route with a crafted nx_id. Because the route lacks proper authorization checks, no credentials are required; any internet‑connected entity can perform the attack, making automated scripts feasible. The impact is limited to defacement or unwanted content injection and does not grant remote code execution.