CVE-2024-1698: NotificationX WordPress Plugin SQLi Flaw

CVE-2024-1698 Overview

CVE-2024-1698 is a critical SQL Injection vulnerability affecting the NotificationX WordPress plugin (also known as "Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor"). The vulnerability exists in all versions up to and including 2.8.2 and is caused by insufficient escaping of user-supplied input in the type parameter, combined with inadequate preparation of the existing SQL query.

This flaw enables unauthenticated attackers to inject malicious SQL queries that append to legitimate database queries, potentially allowing extraction of sensitive information from the WordPress database, including user credentials, configuration data, and other stored content.

Critical Impact

Unauthenticated attackers can exploit this SQL Injection vulnerability to extract sensitive data from WordPress databases without requiring any authentication, posing an immediate threat to all sites running vulnerable versions of the NotificationX plugin.

Affected Products

• WPDeveloper NotificationX versions up to and including 2.8.2
• WordPress installations with NotificationX plugin installed
• WooCommerce integrations using NotificationX for sales popups

Discovery Timeline

• February 27, 2024 - CVE-2024-1698 published to NVD
• March 10, 2025 - Last updated in NVD database

Technical Details for CVE-2024-1698

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) exists within the NotificationX plugin's Analytics REST API endpoint. The core issue stems from the plugin directly incorporating user-controlled input from the type parameter into SQL queries without proper sanitization or parameterization.

When the Analytics endpoint processes requests, the type parameter value is insufficiently escaped before being concatenated into SQL queries. This allows attackers to break out of the intended query context and inject arbitrary SQL statements. Because the endpoint is accessible without authentication, any remote attacker can exploit this vulnerability to interact with the underlying WordPress database.

The exploitation does not require any user interaction or special privileges, making it particularly dangerous for internet-facing WordPress sites. Successful exploitation can lead to complete database compromise, including extraction of user password hashes, email addresses, and potentially sensitive plugin configuration data.

Root Cause

The root cause of CVE-2024-1698 lies in the inadequate input validation and sanitization within the Database.php and Analytics.php files of the NotificationX plugin. Specifically, the type parameter passed through the REST API is not properly escaped using WordPress's built-in database preparation functions before being included in SQL query strings. This violates secure coding practices that mandate parameterized queries or prepared statements for any database operations involving user input.

Attack Vector

The attack is network-based and targets the NotificationX REST API endpoint. An unauthenticated attacker can craft malicious HTTP requests containing SQL injection payloads in the type parameter. Since no authentication is required to access the vulnerable endpoint, attackers can remotely probe and exploit the vulnerability directly from the internet.

The attack flow typically involves:

1. Identifying WordPress sites running vulnerable NotificationX versions
2. Sending crafted requests to the Analytics REST endpoint with SQL injection payloads in the type parameter
3. Using techniques such as UNION-based, boolean-based blind, or time-based blind SQL injection to extract database contents
4. Exfiltrating sensitive data including WordPress user tables, plugin configurations, and potentially wp-config database credentials

For detailed technical analysis of the exploitation methodology, refer to the Vicarius Analysis of CVE-2024-1698.

Detection Methods for CVE-2024-1698

Indicators of Compromise

• Unusual or malformed requests to NotificationX REST API endpoints containing SQL syntax characters (quotes, semicolons, UNION statements)
• Database query errors in WordPress debug logs indicating SQL syntax errors
• Unexpected database access patterns or queries targeting wp_users or other sensitive tables
• Web server logs showing repeated requests to /wp-json/notificationx/ endpoints with encoded payloads

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in request parameters, particularly targeting the type parameter
• Monitor WordPress REST API access logs for anomalous request patterns to NotificationX endpoints
• Deploy database activity monitoring to detect unauthorized SELECT queries against sensitive tables
• Use security scanning tools like Wordfence to identify vulnerable plugin versions

Monitoring Recommendations

• Enable detailed logging for WordPress REST API requests and review for SQL injection indicators
• Set up alerts for high-frequency requests to NotificationX API endpoints from single IP addresses
• Monitor database query performance for unusual patterns that may indicate time-based blind SQL injection attempts
• Regularly audit installed plugin versions and compare against known vulnerable version lists

How to Mitigate CVE-2024-1698

Immediate Actions Required

• Update NotificationX plugin immediately to version 2.8.3 or later
• Review database access logs for signs of prior exploitation
• Consider temporarily disabling the NotificationX plugin if immediate patching is not possible
• Implement WAF rules to block requests containing SQL injection patterns to the NotificationX REST endpoints
• Rotate WordPress admin and database credentials as a precautionary measure

Patch Information

WPDeveloper has released security patches addressing this vulnerability. The fix involves properly sanitizing the type parameter and implementing prepared statements for database queries. The patches can be reviewed in the following WordPress Trac changesets:

• Database.php Changeset
• Analytics.php Changeset

For additional vulnerability intelligence, see the Wordfence Vulnerability Report.

Workarounds

• Implement a Web Application Firewall rule to block or sanitize the type parameter in requests to NotificationX REST endpoints
• Restrict access to WordPress REST API endpoints at the web server level using IP whitelisting where feasible
• Temporarily disable the NotificationX plugin until patching can be completed
• Use WordPress security plugins to add additional input validation layers

# Example .htaccess rule to block suspicious requests to NotificationX endpoints
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (union|select|insert|drop|delete|update|concat|char|0x) [NC]
    RewriteCond %{REQUEST_URI} ^/wp-json/notificationx/ [NC]
    RewriteRule ^(.*)$ - [F,L]
</IfModule>