CVE-2024-1698: SQL Injection in NotificationX Plugin

The SQL Injection vulnerability in NotificationX allows attackers to directly manipulate database queries. An attacker could exploit this to extract sensitive information such as user credentials, customer data, order details, and potentially even WordPress administrative user information. Successful exploitation could lead to complete compromise of the WordPress site and its associated data. The lack of authentication required to trigger the vulnerability significantly increases the attack surface, making it a high-priority concern. This vulnerability shares similarities with other SQL Injection flaws where attackers can bypass security controls and gain unauthorized access to backend systems.

1. Reserved2024-02-21
2. Published2024-02-27
3. Modified2024-08-27
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-1698 is to immediately upgrade the NotificationX plugin to a version that includes the security patch. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to filter out malicious SQL injection attempts targeting the 'type' parameter. Additionally, review and harden WordPress database user permissions to limit the potential damage from a successful attack. Monitor WordPress access logs for suspicious SQL queries.

Active installs

40KKnown

Plugin rating

4.8

Requires WordPress

5.0+

Compatible up to

7.0

Requires PHP

5.6+