CVE-2024-11012

MEDIUM

The Notibar - Notification Bar for WordPress plugin <2.1.4 - RCE

Title source: llm

Description

The The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via njt_nofi_text AJAX action in all versions up to, and including, 2.1.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.

References (4)

Core 4

Core References

Product

https://plugins.trac.wordpress.org/browser/notibar/trunk/includes/NotificationBar/WpCustomNotification.php#L90

Product

https://plugins.trac.wordpress.org/changeset/3205224/

Product

https://wordpress.org/plugins/notibar/#developers

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/1766727d-ba54-4b46-b362-415c14be027d?source=cve

Scores

CVSS v3 6.3

EPSS 0.0046

EPSS Percentile 36.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-94

Status published

Products (1)

ninjateam/Notibar – Notification Bar for WordPress < 2.1.4

Published Dec 13, 2024

Tracked Since Feb 18, 2026