{"id":"CVE-2026-78139","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-78139","generatedAt":"2026-10-28T07:26:13.575Z","title":"The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to…","description":"The Notifima  WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product stock-alert notifications.","published":"2026-08-27T06:17:30.000Z","lastModified":"2026-08-28T18:43:26.000Z","status":"Deferred","sourceIdentifier":"contact@wpscan.com","cvss":{"version":"3.1","score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},"cwe":["CWE-639"],"affected":[],"epss":{"score":0.00254,"percentile":0.16883,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://wpscan.com/vulnerability/b1a0e23b-35f7-4282-83f6-1917c89f7b4c/","source":"contact@wpscan.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-78139","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}