WordPress Plugin Vulnerabilities

Notifima < 3.1.4 - Subscriber+ Stock Alert Unsubscription via IDOR

Description

The plugin does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product stock-alert notifications.

Proof of Concept

Affects Plugins

Plugin icon
woocommerce-product-stock-alert
Fixed in 3.1.4

References

CVE
CVE-2026-78139

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Shikhali Jamalzade
Submitter
Shikhali Jamalzade
Submitter website
https://alisalive.vercel.app
Submitter twitter
0xAlisAlive
Verified
Yes
WPVDB ID
b1a0e23b-35f7-4282-83f6-1917c89f7b4c

Timeline

Publicly Published
2026-08-25 (about 3 days ago)
Added
2026-08-25 (about 2 days ago)
Last Updated
2026-08-25 (about 2 days ago)

Other

Published
Title
Published
2026-07-20
Title
Event Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDOR
Published
2025-10-16
Title
Binary MLM Plan <= 5.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-08-14
Title
WP Crowdfunding < 2.2.1 - Unauthenticated Insecure Direct Object Reference
Published
2026-03-10
Title
Happy Addons for Elementor < 3.21.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post_id' Parameter
Published
2025-03-19
Title
NP Quote Request for WooCommerce < 1.9.180 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure