Description

The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product stock-alert notifications.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-27T06:17:29.707Z",
  "pubdate": "2026-08-27T06:17:29.707Z",
  "executiveSummary": "The Notifima WordPress plugin, in versions up to and including 3.1.3, contains a critical broken access control vulnerability within its REST API endpoints.\nThis vulnerability is classified as an Insecure Direct Object Reference (IDOR) flaw, allowing authenticated users with minimal privileges—specifically Subscriber-level accounts—to perform unauthorized operations on data belonging to other users.\nThe primary impact is the unauthorized modification of subscription data, specifically enabling an attacker to force the unsubscription of arbitrary customers from product stock-alert notifications.\nThe vulnerability stems from a failure in the application logic to validate the ownership of the subscription resource during REST API requests.\nThis represents a significant integrity and privacy issue, as it permits low-privileged attackers to disrupt service communication and manipulate user preferences without authorization.\nSuccessful exploitation does not require administrative privileges, significantly expanding the potential attacker surface to any registered user on the WordPress installation.",
  "technicalDetails": "The vulnerability resides within the Notifima REST API implementation, specifically in the endpoint responsible for processing subscription modifications.\nThe root cause is a lack of server-side authorization checks during the request handling process. When a user initiates a request to modify a subscription, the plugin fails to verify whether the currently authenticated user is the legitimate owner of the subscription ID specified in the request payload.\nThe affected component is the REST API controller responsible for handling stock-alert unsubscription requests. Because the validation logic relies solely on the authentication of the caller rather than an authorization check against the specific resource ID, the API is susceptible to IDOR-based manipulation.\nAn attacker with at least Subscriber-level access can perform the following attack flow: 1. Identify the target REST API endpoint used by Notifima to manage stock-alert notifications. 2. Observe the structure of the API request, specifically identifying the parameter used to pass the subscription identifier (e.g., subscription_id). 3. Authenticate to the WordPress site as a subscriber. 4. Craft a malicious HTTP request (typically a DELETE or a modified POST request) to the target endpoint, substituting the subscription_id of a legitimate customer with the target identifier. 5. Submit the request to the server.\nUpon receiving the request, the plugin processes the action without verifying ownership. The system executes the logic to unsubscribe the user associated with the provided ID, effectively altering the database state to terminate the requested stock-alert notification for the target user.\nThis bypasses intended security controls, allowing an authenticated attacker to perform bulk unsubscriptions if the subscription IDs are predictable or discoverable. The impact post-exploitation includes the silencing of legitimate service notifications, which can be utilized to disrupt commercial operations or target specific user groups within an e-commerce environment.\nThis vulnerability remains present in all versions up to 3.1.3, and there is no evidence of an internal ownership check within the handler function to prevent cross-user resource manipulation."
}