CVE-2026-78139 Overview
CVE-2026-78139 affects the Notifima WordPress plugin in versions up to and including 3.1.3. The plugin exposes a REST endpoint that modifies stock-alert subscriptions without verifying that the caller owns the subscription being modified. Authenticated attackers holding only Subscriber-level access can unsubscribe arbitrary customers from product stock-alert notifications. The issue is fixed in version 3.1.4.
Critical Impact
Any authenticated user with Subscriber privileges can tamper with other customers' stock-alert subscriptions, disrupting a merchant's notification workflow and eroding customer trust.
Affected Products
- Notifima WordPress plugin versions prior to 3.1.4
- WordPress sites running Notifima 3.1.3 and earlier
- WooCommerce stores using Notifima for stock-alert notifications
Discovery Timeline
- 2026-08-27 - CVE-2026-78139 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-78139
Vulnerability Analysis
The Notifima plugin provides product stock-alert subscriptions on WordPress and WooCommerce stores. Customers subscribe to receive notifications when out-of-stock products are restocked. The plugin exposes a REST API endpoint that modifies these subscriptions. The endpoint performs an authentication check but omits an ownership check against the target subscription record. This is a Broken Access Control weakness aligned with [CWE-284] and [CWE-639] Insecure Direct Object Reference.
Root Cause
The REST route handler does not compare the authenticated user identity against the owner of the subscription referenced by the request. Because WordPress considers the Subscriber role authenticated, any registered account satisfies the endpoint's permission callback. The handler proceeds to modify or delete a subscription record identified only by an attacker-supplied parameter.
Attack Vector
An attacker registers or logs in to a target site with a Subscriber-level account, which most WooCommerce and membership-driven sites allow by default. The attacker sends an authenticated request to the vulnerable REST endpoint, supplying an identifier or email for a subscription belonging to another customer. The endpoint removes that subscription without verifying ownership. Repeated requests can enumerate and unsubscribe every customer awaiting stock alerts.
No verified proof-of-concept code has been published. Refer to the WPScan Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-78139
Indicators of Compromise
- Unexpected drops in active stock-alert subscription counts within Notifima's admin dashboard.
- Customer support tickets reporting that expected back-in-stock emails never arrived.
- Authenticated REST requests to Notifima endpoints originating from Subscriber-role accounts.
Detection Strategies
- Audit web server access logs for authenticated POST, PUT, or DELETE requests to /wp-json/ routes exposed by Notifima.
- Correlate REST endpoint activity with the WordPress user role of the requester and flag Subscriber accounts modifying subscription records.
- Review database change history on the Notifima subscription table for deletions not initiated by administrators or the affected customer.
Monitoring Recommendations
- Enable request logging on the WordPress REST API and forward logs to a centralized analytics platform for correlation.
- Alert on newly registered Subscriber accounts that immediately begin interacting with plugin REST endpoints.
- Track baseline subscription counts and alert on statistically significant decreases.
How to Mitigate CVE-2026-78139
Immediate Actions Required
- Upgrade the Notifima plugin to version 3.1.4 or later on all affected WordPress sites.
- Review recent REST API activity for Subscriber-role accounts and revoke suspicious accounts.
- Restore any wrongly removed subscription records from database backups where possible.
Patch Information
The vendor addressed the issue in Notifima 3.1.4 by adding an ownership check to the REST endpoint that modifies stock-alert subscriptions. Site operators should update through the WordPress plugin manager or replace the plugin directory with the fixed release. See the WPScan Vulnerability Report for advisory details.
Workarounds
- Disable the Notifima plugin until the site is upgraded to version 3.1.4.
- Restrict new user registration or require administrator approval to reduce the pool of Subscriber-level accounts.
- Block unauthenticated and Subscriber-role access to Notifima REST routes at the web application firewall until patching is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
