CVE-2024-1698: NotificationX WordPress plugin unauthenticated SQL injection via type parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable SQL injection with CVSS 9.8 and very high EPSS, plus public exploit material, makes this an urgent patch.

What it is

The NotificationX WordPress plugin fails to escape the 'type' parameter and does not properly prepare an existing SQL query, allowing SQL injection in all versions up to and including 2.8.2. Because the flaw is reachable without authentication, it exposes the site's database to direct query manipulation.

Impact

An attacker can append arbitrary SQL to existing queries and extract sensitive information from the database, with the CVSS vector also indicating potential integrity and availability impact. This can expose credentials, user data and other stored secrets.

Attack surface

The vulnerability is network-reachable through the plugin's handling of the 'type' parameter, and the CVSS vector shows no privileges or user interaction required. No authentication is needed to reach the vulnerable query path.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high at 0.77585 (99.5th percentile) and a public reference is tagged Exploit, indicating exploit code and technical analysis are available.

What to do

• Update the NotificationX plugin to a version newer than 2.8.2, applying the vendor patch referenced in the changesets.
• If immediate patching is not possible, disable or remove the NotificationX plugin until it can be updated.
• Use a web application firewall to block SQL injection patterns targeting the plugin's REST/analytics endpoints.
• Restrict access to plugin REST endpoints where feasible and monitor for unexpected requests to them.
• Review database and application logs for signs of SQL injection attempts against the 'type' parameter.

Detection

• Search web server and WAF logs for requests containing SQL metacharacters or UNION/OR patterns in the 'type' parameter.
• Monitor for anomalous requests to NotificationX REST or analytics endpoints, especially from unauthenticated clients.
• Alert on database errors or unusual query behavior correlated with plugin endpoint traffic.
• Hunt for outbound data exfiltration or unexpected database reads following suspicious plugin requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.