Key points
- The flaw affects WPDeveloper NotificationX plugin versions prior to 2.3.12.
- Attackers can manipulate database queries using a crafted array-form ID parameter.
- Shadowserver Foundation observed exploitation attempts starting in October 2023.
Site administrators must update the NotificationX plugin for WordPress to version 2.3.12 or later immediately to block a high-severity SQL injection vector. The vulnerability allows unauthenticated attackers to inject SQL commands through a specific API endpoint, potentially exposing sensitive data stored in the database.
In plain English
The NotificationX plugin has a flaw that lets outsiders send malicious code to your website’s database without needing a login. Hackers send a special request to a web address ending in a notification ID. If the plugin version is older than 2.3.12, it processes this request incorrectly.
The background
The issue stems from how the plugin handles an 'id' parameter sent to its API. Attackers supply an array-form ID containing crafted SQL commands, such as time-based delays. These commands flow unsanitized into the database query function. This allows them to extract database contents or manipulate queries.
What changes now
WPDeveloper has released version 2.3.12, which fixes this unauthenticated SQL injection vulnerability. Sites running older versions remain exposed to the risk described in CVE-2022-51021. Updating to the patched version removes the ability for attackers to inject these malicious SQL commands through the API endpoint.
Who needs to act first
Teams usually prioritize systems exposed directly to the internet, especially those handling public notifications or user interactions. Check whether your site uses the NotificationX plugin before updating.
What to do and how to stay safe
- Rapid deployment increases the likelihood of configuration drift and service disruption.
- Verify patch integrity using cryptographic hashes before applying any update.
- Maintain a rollback plan to restore systems if the patch causes instability.
Emergency patching requires balancing speed with safety to avoid introducing new risks. Implement automated testing and rollback procedures to streamline future updates.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
