Vulnerability · Published Sep 22, 2025 · Assigned by GitHub_M

CVE-2025-59413CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter

Medium 6.5

In plain English

A medium-severity missing authorization in v6 from cubecart. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 65.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.

Affected products (as reported)

Vendor	Product	Versions
cubecart	v6	< 6.5.11

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7f x_refsource_CONFIRM
https://github.com/cubecart/v6/commit/7fd1cd04f5d5c3ce1d7980327464f0ff6551de79 x_refsource_MISC
https://github.com/cubecart/v6/commit/db965fcfa260c4f17eb16f8c5494e5af4a8ac271 x_refsource_MISC
https://github.com/cubecart/v6/commit/dbc58cf1f7a6291f7add5893b56bff7920a29128 x_refsource_MISC