blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-78139

MEDIUM 4.3 CVSS 3.1
Published
August 27, 2026
Last modified
August 28, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-639
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product stock-alert notifications.

Affected products and versions

  • Unknown Notifima — Before 3.1.4

References

  • wpscan.com https://wpscan.com/vulnerability/b1a0e23b-35f7-4282-83f6-1917c89f7b4c/
  • nvd.nist.gov Official NVD record