Vulnerability Description
CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cubecart | Cubecart | < 6.5.11 |
Related Weaknesses (CWE)
References
- https://github.com/cubecart/v6/commit/7fd1cd04f5d5c3ce1d7980327464f0ff6551de79Patch
- https://github.com/cubecart/v6/commit/db965fcfa260c4f17eb16f8c5494e5af4a8ac271Patch
- https://github.com/cubecart/v6/commit/dbc58cf1f7a6291f7add5893b56bff7920a29128Patch
- https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7fExploitVendor Advisory
- https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7fExploitVendor Advisory
FAQ
What is CVE-2025-59413?
CVE-2025-59413 is a vulnerability with a CVSS score of 6.5 (MEDIUM). CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. ...
How severe is CVE-2025-59413?
CVE-2025-59413 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-59413?
Check the references section above for vendor advisories and patch information. Affected products include: Cubecart Cubecart.