CVE-2022-51021highexplotación observadaCWE-89

CVE-2022-51021: fallo de gravedad alta en WPDeveloper NotificationX

NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpoint

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear NotificationX

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

43Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck.

ssvc Actcvss 8.8epss 0.5%
de la publicación al arma
Publicada en NVD22 oct
VulnCheck22 oct
NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/{id}. Attackers can pass id[1] with crafted SQL, such as time-based SLEEP payloads, along with an api_key derived from md5(home_url()), which flows unsanitized into Database::get_where_query to extract database contents. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
WPDeveloper · NotificationX
CVEs relacionadas — WPDeveloper NotificationX

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-22683MEDIUMWordPress NotificationX plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-27042MEDIUMWordPress NotificationX plugin <= 3.2.1 - Broken Access Control vulnerabilityEPSS 0.2%