Medium severity · published Sep 22, 2025
CVE-2025-59413
CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
V6
v6 · cubecart
< 6.5.11 · source: vendor
CU
Cubecart · Cubecart
before 6.5.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59413
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59413
Patch
https://github.com/cubecart/v6/commit/7fd1cd04f5d5c3ce1d7980327464f0ff6551de79
Patch
https://github.com/cubecart/v6/commit/db965fcfa260c4f17eb16f8c5494e5af4a8ac271
Patch
https://github.com/cubecart/v6/commit/dbc58cf1f7a6291f7add5893b56bff7920a29128
Exploit
https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7f
More from v6
9.1
CVE-2026-45714
CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
9.1
CVE-2026-45053
CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API
9.1
CVE-2026-44377
CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
8.1
CVE-2026-45055
CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header
7.2
CVE-2026-54647
CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php