{"affected":[{"defaultStatus":"unaffected","product":"NotificationX","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"3.3.7","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-119303","cwes":["CWE-862"],"description":"The NotificationX  WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX  WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/0280952e-f388-44a3-a891-5855580a5f5b/"}],"kev":null,"metrics":[],"modifiedAt":1794376810373,"publishedAt":1794376810373,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/0280952e-f388-44a3-a891-5855580a5f5b/"}],"remediation":[],"revision":"00fc50514f350c698e66f9693c32506b566a3cc13eb0198e2e87318034d33cd8","sources":[{"modifiedAt":1794376810373,"name":"CNA: WPScan","retrievedAt":1794377383878,"url":"https://www.cve.org/CVERecord?id=CVE-2026-119303"}],"ssvc":null,"status":"published","title":"NotificationX < 3.3.7 - Unauthenticated Settings Update and Email Sending via send-rating REST Route","updatedAt":1794377383878}