CVE-2025-59413 — CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter
CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user …
Published: 2025-09-22 · CVSS: 6.5 · CVSS 3.1
CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7