cve-2022-51021

{
  "cvss": 8.8,
  "datePublished": "2026-10-22T00:00:00Z",
  "dateUpdated": "2026-10-22T00:00:00Z",
  "description": "NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/{id}. Attackers can pass id[1] with crafted SQL, such as time-based SLEEP payloads, along with an api_key derived from md5(home_url()), which flows unsanitized into Database::get_where_query to extract database contents. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.",
  "dueDate": "",
  "id": "CVE-2022-51021",
  "kev_catalogs": [
    "vulncheck"
  ],
  "knownRansomwareCampaignUse": "Unknown",
  "product": "NotificationX",
  "requiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.",
  "severity": "HIGH",
  "source": "vulncheck_kev",
  "title": "WPDeveloper notificationx Improper Neutralization of Special Elements used in an SQL Command",
  "vendor": "WPDeveloper"
}