CVE-2024-11012 is a code injection vulnerability in the Notibar – Notification Bar for WordPress plugin by ninjateam. The flaw exists in the njt_nofi_text AJAX action, which improperly validates user input before executing it via the do_shortcode function. Authenticated attackers with Subscriber-level privileges or higher can exploit this to execute arbitrary shortcodes, potentially impacting confidentiality, integrity, and availability of the WordPress site. The vulnerability affects all versions up to and including 2.1.4. No patch or official remediation has been documented yet.

Exploitation allows authenticated users with low-level privileges (Subscriber and above) to execute arbitrary shortcodes, which could lead to unauthorized actions within the WordPress environment. The CVSS score of 6.3 reflects a medium impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to trusted users only and monitor for suspicious shortcode activity. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from ninjateam for any forthcoming patches.