Authorization Bypass Vulnerability in Notifima WordPress Plugin
CVE-2026-78139
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-78139?
The Notifima WordPress plugin before version 3.1.4 lacks proper validation of subscription ownership on its REST endpoints. This oversight allows authenticated users with Subscriber-level access to manipulate subscription settings, specifically the ability to unsubscribe any customer from receiving product stock-alert notifications. This vulnerability can lead to unauthorized access and modification of customer notifications, potentially affecting user trust and product engagement.
Affected Version(s)
Notifima 0 < 3.1.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.