The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product stock-alert notifications.
CVE-2026-78139
NONE
Updated Aug 27, 2026
WordPress
CVE Details
CVE ID
CVE-2026-78139
Published Date
Aug 27, 2026
Vendor
WordPress
Severity
NONE
Impact
Minimal impact
Source
View Advisory