WordPress NotificationX SQL Injection: Shadowserver Spies Attacks on Plugin Before 2.3.12

Security researchers identified a high-severity SQL injection vulnerability in the WordPress NotificationX plugin. This flaw allows remote attackers to manipulate database queries without authentication. The issue stems from improper sanitization of input parameters within the plugin's REST API endpoints, potentially exposing sensitive database contents to unauthorized users.

Root cause

The vulnerability exists because the plugin fails to sanitize the 'id' parameter supplied to its JSON endpoint. Attackers can pass an array-form 'id' parameter containing crafted SQL statements. This input flows directly into the Database::get_where_query function without validation. The lack of proper escaping allows the execution of arbitrary SQL commands against the underlying database system.

Attack path

Exploitation requires an attacker to construct a specific request to the /wp-json/notificationx/v1/notification/{id} endpoint. They must supply an api_key derived from the md5 hash of the home URL. By including a time-based SLEEP payload within the id[1] parameter, attackers can confirm the vulnerability. This technique allows them to extract database contents remotely without needing valid user credentials.

Affected versions

• WordPress NotificationX versions before 2.3.12 are affected.
• Version 2.3.12 and later contain the fix.

Mitigation

• Update the NotificationX plugin to version 2.3.12 or later immediately.
• Monitor web server logs for unusual requests to the notificationx endpoint.
• Implement a web application firewall to block suspicious SQL injection patterns.

Detection notes

Security teams should review web server access logs for requests targeting the notificationx JSON endpoint. Look for unusual query parameters, particularly array structures or encoded characters in the ID field. Monitor for delayed responses that might indicate time-based blind SQL injection techniques. Check for unauthorized access attempts to sensitive database tables or unexpected data exports. Alert on any requests containing SQL keywords like SLEEP or UNION. Verify that all plugin inputs are properly sanitized and validated before processing. Ensure logging captures full request details for forensic analysis.

Background: SQL injection

SQL injection occurs when untrusted input alters database commands. You remain vulnerable when you concatenate strings, ignore parameterized queries, or trust hidden form fields. Fix these errors by using prepared statements, validating input types, and applying least privilege to database accounts. These steps block most injection attempts.

Read the full guide: SQL Injection Mistakes That Leave Your Database Exposed

What to do and how to stay safe: WordPress

• Audit your WordPress installation for the NotificationX plugin and check its version.
• Update the plugin to the latest available version if you are running an affected release.
• Monitor server logs for suspicious API requests to the notificationx endpoint.
• Review database integrity for any unauthorized changes or data exfiltration signs.

Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for this vulnerability?

The Common Vulnerability Scoring System rates CVE-2022-51021 as 8.8, which is classified as high severity.

How do attackers exploit this flaw?

Attackers send crafted requests with an array-form ID parameter and a derived API key to the plugin's REST API endpoint.

When was this exploitation first observed?

The Shadowserver Foundation first observed evidence of exploitation on October 18, 2023.