HomeWordPress vulnerabilitiesSubscriptions for WooCommerce
Subscriptions for WooCommerce vulnerabilities
Subscriptions for WooCommerce has 8 known vulnerabilities in this database. The most recent published record is dated 16 Sep 2026.
- Known vulnerabilities
- 8
- Active installs
- 10,000+
- Latest version
- 2.0.3
- Last updated
- 9 Sep 2026
- Most recent
- 16 Sep 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Sensitive data exposure CVE-2026-87854 | Medium 5.3 | Before 2.0.3 | Fixed in 2.0.3 | 16 Sep 2026 |
| Broken access control CVE-2026-87860 | Medium 4.3 | Before 2.0.3 | Fixed in 2.0.3 | 16 Sep 2026 |
| Security weakness CVE-2026-15211 | Medium 5.9 | Before 2.0.1 | Fixed in 2.0.1 | 7 Aug 2026 |
| Broken access control CVE-2026-15214 | Medium 4.3 | Before 2.0.1 | Fixed in 2.0.1 | 7 Aug 2026 |
| Remote code execution CVE-2026-15215 | High 8.8 | Before 2.0.1 | Fixed in 2.0.1 | 7 Aug 2026 |
| Privilege escalation CVE-2026-15414 | High 8.8 | Up to 2.0.0 | Fixed in a later version (latest 2.0.3) | 1 Aug 2026 |
| Broken access control CVE-2026-15397 | High 7.2 | Up to 2.0.0 | Fixed in a later version (latest 2.0.3) | 30 Jul 2026 |
| Broken access control CVE-2026-1926 | Medium 5.3 | Up to 1.9.2 | Fixed in a later version (latest 2.0.3) | 18 Mar 2026 |
Read the published descriptions
- CVE-2026-87854, 16 Sep 2026
- The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and payment dates. CVE record
- CVE-2026-87860, 16 Sep 2026
- The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making. CVE record
- CVE-2026-15211, 7 Aug 2026
- The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is COMPLETED, without comparing the captured amount to the order total. This allows an attacker (unauthenticated where guest checkout is enabled) to substitute an approved, uncaptured PayPal order token and have an expensive order marked paid without paying its price. CVE record
- CVE-2026-15214, 7 Aug 2026
- The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information (the subscribed product, status, and dates) by supplying that subscription's ID. CVE record
- CVE-2026-15215, 7 Aug 2026
- The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) to install and activate arbitrary Subscriptions for WooCommerce WordPress plugin before 2.0.1, resulting in remote code execution. CVE record
- CVE-2026-15414, 1 Aug 2026
- The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the `save_meta_boxes()` function persisting the `_wps_plan_user_role` membership plan meta from `$_POST` without an allowlist that excludes privileged roles - the only validations applied, `sanitize_key()` and `wp_roles()->is_role()`, both accept `'administrator'` as a valid value, and the UI's `disabled` attribute on the role dropdown is a client-side-only control trivially bypassed via DevTools or a direct POST request; additionally, because the `wps_membership_plan` custom post type is registered with `capability_type => 'post'`, any user who can edit posts satisfies the `current_user_can('edit_post', $post_id)` guard in `save_meta_boxes()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their privileges to Administrator by storing `'administrator'` as the role granted on membership acquisition, which the Pro companion plugin then applies via `add_role()` during membership lifecycle events. Successful exploitation requires the Subscriptions for WooCommerce Pro companion plugin to be active, as it is the component that reads the stored `_wps_plan_user_role` meta via `get_post_meta()` and calls `add_role()` to apply the role during membership lifecycle events. CVE record
- CVE-2026-15397, 30 Jul 2026
- The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via the wps_sfw_install_plugin_configuration AJAX handler. This makes it possible for authenticated attackers, with shop manager-level access and above, to install and activate arbitrary WordPress.org plugins. CVE record
- CVE-2026-1926, 18 Mar 2026
- The Subscriptions for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `wps_sfw_admin_cancel_susbcription()` function in all versions up to, and including, 1.9.2. This is due to the function being hooked to the `init` action without any authentication or authorization checks, and only performing a non-empty check on the nonce parameter without actually validating it via `wp_verify_nonce()`. This makes it possible for unauthenticated attackers to cancel any active WooCommerce subscription by sending a crafted GET request with an arbitrary nonce value via the `wps_subscription_id` parameter. CVE record
What to do if you run Subscriptions for WooCommerce
If you run Subscriptions for WooCommerce, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new Subscriptions for WooCommerce vulnerabilities
Free. We email you when a new vulnerability is published for Subscriptions for WooCommerce, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.