Executive brief
Notifima is a WordPress plugin for WooCommerce that manages product stock-alert subscriptions. The plugin fails to verify that a user requesting an unsubscribe action owns the subscription being modified, allowing any authenticated user with basic subscriber access to unsubscribe other customers from notifications. This undermines notification delivery for customers who want to remain subscribed to product restocks.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in a REST API endpoint used to manage stock-alert subscriptions. The vulnerable endpoint at /notifima/v1/subscribers/{id} fails to validate that the authenticated caller owns the subscription before processing an unsubscribe action; instead, it relies solely on a customer_email parameter to identify the target subscription. An authenticated attacker with Subscriber-level privileges can craft a POST request with a REST nonce (available to any logged-in user) to unsubscribe arbitrary customers from product notifications. No special privileges or bypasses are required—the endpoint correctly enforces authentication via nonce, but lacks authorization checks. The issue was fixed in version 3.1.4; all versions up to 3.1.3 are affected.
Affected products
- Notifima Notifima before 3.1.4
Timeline
- 2026-08-25: disclosed
- 2026-08-27: advisory
- 2026-08-27: patched: Fixed in version 3.1.4