CVE-2026-119303
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Nov 11, 2026
Vendor
unknown
Description
The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server.