Medium severity6.5NVD Advisory· Published Nov 11, 2026

CVE-2026-119302

Description

The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered shortcodes by supplying crafted preview data on any front-end request.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Notificationxllm-fuzzy
Range: <3.3.7
Package: https://wordpress.org/plugins/notificationx

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/e0264d07-668c-46f7-acab-0a7b59edb45f/nvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000