CVE-2026-78139: 
WordPress vulnerability analysis and mitigation

CVE-2026-78139 is an Insecure Direct Object Reference (IDOR) vulnerability in the Notifima WordPress plugin that allows authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product stock-alert notifications. It affects all versions of the plugin up to and including 3.1.3, with version 3.1.4 containing the fix. The vulnerability was publicly disclosed on August 25, 2026, and assigned a CVSS score of 4.3 (Medium) (WPScan, GitHub Advisory).

The root cause is a missing ownership verification check on a REST API endpoint within the Notifima plugin (CWE-639: Authorization Bypass Through User-Controlled Key), classified as an IDOR under OWASP Top 10 A5: Broken Access Control. An authenticated user with only Subscriber-level privileges can send a crafted REST API request referencing another customer's subscription identifier, and the plugin will process the modification without confirming the requester owns that subscription. No special configuration or elevated privileges beyond a basic WordPress account are required to exploit this flaw. A proof-of-concept is scheduled for public release on September 8, 2026, to allow time for users to update (WPScan).

Successful exploitation allows any authenticated WordPress subscriber to unsubscribe arbitrary customers from WooCommerce product stock-alert notifications managed by the Notifima plugin. This primarily affects the integrity and availability of notification services — targeted customers will not receive back-in-stock alerts they opted into, potentially causing missed purchase opportunities and customer dissatisfaction. While the vulnerability does not expose sensitive data or enable remote code execution, it can be used for targeted business disruption against e-commerce stores relying on stock-alert notifications for sales (WPScan, GitHub Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time, though WPScan has indicated a PoC will be released on September 8, 2026. The EPSS score is 0.0, reflecting low current exploitation probability, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only a valid WordPress account with Subscriber-level access, making it low-barrier once a PoC is available (WPScan, GitHub Advisory).

1. Obtain a low-privilege account: Register or obtain a Subscriber-level WordPress account on a target site running Notifima < 3.1.4.
2. Identify the vulnerable REST endpoint: Locate the Notifima REST API endpoint responsible for managing stock-alert subscriptions (e.g., via plugin source code review or API enumeration).
3. Enumerate subscription IDs: Send authenticated REST API requests with varying subscription identifiers (e.g., incrementing integer IDs) to discover valid subscriptions belonging to other customers.
4. Send unauthorized unsubscribe request: Craft an authenticated REST API request targeting a discovered subscription ID that belongs to another customer, triggering the unsubscribe action without ownership verification.
5. Confirm impact: Verify that the targeted customer's stock-alert subscription has been removed, confirming successful exploitation (WPScan).

• Logs: WordPress REST API access logs showing repeated authenticated requests to Notifima subscription endpoints from a single low-privilege user account, particularly with varying subscription IDs in rapid succession.
• Database: Unexpected bulk removal of entries in the Notifima subscription table (e.g., wp_notifima_subscribers or equivalent) not correlated with legitimate customer opt-outs.
• Network: Unusual patterns of REST API calls (e.g., POST or DELETE requests to /wp-json/notifima/v*/subscription/*) from a single IP or user agent targeting multiple subscription IDs.

Update the Notifima WordPress plugin to version 3.1.4 or later, which introduces proper ownership verification on the affected REST endpoint (WPScan). As a temporary workaround prior to patching, site administrators can restrict REST API access to authenticated users only or temporarily disable the plugin if stock-alert functionality is not critical. Monitoring REST API logs for unusual subscription modification activity is also recommended.

The vulnerability was discovered and reported by researcher Shikhali Jamalzade (Twitter: @0xAlisAlive), who submitted it through WPScan's responsible disclosure process. No significant broader media coverage or notable community commentary has been identified beyond the standard vulnerability database publications (WPScan).