CVE-2025-59413 - CVE House
Back to Database
Status published Medium CVE-2025-59413

CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter

Vulnerability Description

CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59413

Credits & Attribution

No credits recorded in the NVD database.

References

More from cubecart

View All →
CVE-2025-59412
CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement
Medium 5.4
CVE-2025-59411
CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry
Medium 5.4
CVE-2025-59335
CubeCart Session Not Invalidated After Password Change
High 7.1
CVE-2021-33394
Cubecart 6.4.2 allows Session Fixation. The application does not generate...
Medium 5.4
CVE-2018-20716
CubeCart before 6.1.13 has SQL Injection via the validate[] parameter...
Critical 9.8

Affected Vendor

Affected Software

v6
Vulnerable Versions:
< 6.5.11

Timeline

Official Publish: September 22nd, 2025
Last Modified: September 22nd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weaknesses (CWE)

CWE-862

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1078 Valid Accounts
Persistence
T1531 Account Access Removal
Impact