NotificationX: Unauthenticated SQL injection (CVE-2022-51021)

The NotificationX plugin for WordPress versions 2.0.0 through 2.3.11 contains an unauthenticated SQL injection vulnerability (CVE-2022-51021). The vulnerability resides in the REST API endpoint /wp-json/notificationx/v1/notification/{id}. Remote attackers can exploit this by passing an array-form id parameter containing crafted SQL payloads alongside an API key derived from md5(home_url()). The unsanitized input is passed to the Database::get_where_query function, enabling unauthorized database interaction and information extraction.

Impact

Successful exploitation allows for the extraction of sensitive database contents. The Shadowserver Foundation documented in-the-wild exploitation of this vulnerability starting on October 18, 2023.

Recommendation

• Update the NotificationX plugin to version 2.3.12 or later immediately.
• Audit database logs for unusual queries originating from the REST API endpoint /wp-json/notificationx/v1/notification/.
• Deploy web application firewall (WAF) rules to detect and block incoming POST or GET requests to the identified vulnerable endpoint containing SQL injection patterns such as SLEEP, UNION, or SELECT keywords in query parameters.