CVE-2026-110721: CWE-862 Missing Authorization in wpdevteam NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar

The NotificationX WordPress plugin (up to and including version 3.3.3) suffers from a missing authorization vulnerability (CWE-862) in the REST route /notificationx/v1/popup-submit. The route's permission_callback is set to '__return_true', allowing any unauthenticated user to invoke it. The handler function PopupNotification::handle_popup_submission() accepts an attacker-controlled nx_id parameter, loads the corresponding NotificationX campaign, and copies its source content into a new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup. This enables attackers to inject forged social-proof entries (including name, title, message, email, and theme) into any enabled non-popup NotificationX campaign such as WP Comments, WooCommerce sales, reviews, and others.

An unauthenticated attacker can inject arbitrary forged social-proof content into NotificationX campaigns that are not popup notifications. This could mislead users by displaying false social proof messages, potentially damaging trust or influencing user behavior. The vulnerability does not impact confidentiality or availability but affects integrity of displayed content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable REST endpoint if possible or disable the NotificationX plugin. Monitor vendor channels for updates and apply patches promptly once released.