CVE-2025-59413
MEDIUMCubeCart < 6.5.11 - Unauthenticated Newsletter Subscription Tampering via Force Unsubscribe Parameter
Title source: llmDescription
CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.
References (4)
Core 4
Core References
Exploit, Vendor Advisory x_refsource_confirm
https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7f
Patch x_refsource_misc
https://github.com/cubecart/v6/commit/7fd1cd04f5d5c3ce1d7980327464f0ff6551de79
Patch x_refsource_misc
https://github.com/cubecart/v6/commit/db965fcfa260c4f17eb16f8c5494e5af4a8ac271
Patch x_refsource_misc
https://github.com/cubecart/v6/commit/dbc58cf1f7a6291f7add5893b56bff7920a29128
Scores
CVSS v3
6.5
EPSS
0.0037
EPSS Percentile
29.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-862
Status
published
Products (1)
cubecart/cubecart
< 6.5.11
Published
Sep 22, 2025
Tracked Since
Feb 18, 2026