CVE-2024-1698 is a critical (CVSS 9.8) SQL injection flaw in the NotificationX plugin for WordPress, in all versions up to and including 2.8.2. Unauthenticated attackers can append SQL through the type parameter. The fix is to update to a release newer than 2.8.2.
What's affected
The record says all versions through 2.8.2 are affected, because of insufficient escaping of the user supplied type parameter and a lack of preparation of the existing SQL query. It says unauthenticated attackers can append additional queries to extract sensitive information from the database. The references include two WordPress plugin changesets (3040809) touching the database and analytics REST code, and a Wordfence entry. We did not fetch them, so confirm the first fixed version on the plugin page.
The NVD score is 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The weakness is CWE-89 (SQL injection).
How to check if you're exposed
Check the plugin version with WP-CLI.
wp plugin get notificationx --field=version
Anything at or below 2.8.2 is affected. Because no login is needed, also review web server logs for unusual requests to the plugin's REST analytics routes, and review your database for unexpected changes. If you cannot update immediately, deactivating the plugin removes the exposure.
What to do now
- Update NotificationX to a version newer than 2.8.2 now.
- If you cannot update, deactivate the plugin until you can.
- Rotate administrator passwords and secrets stored in the database if you suspect the site was probed.
- Review logs for odd requests to the plugin's REST routes.
- Keep automatic updates on for plugins that run on public pages.
Why it matters
SQL injection is an old class of flaw with a simple cause: user input gets added to a query as text instead of passed as a parameter. Prepared statements fix it. Here the record says the query was not prepared and the parameter was not escaped enough.
The score is critical because the endpoint needs no login and the database holds user data and credentials. A public researcher write up exists, which the record links, so site owners should assume the technique is known. The KEV flag is false. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need to log in?
No. The record says unauthenticated attackers can exploit it.
Sources
Last reviewed: 19 October 2026.
