Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-06
Subscriptions for WooCommerce - Security Vulnerability (CVE-2026-87856)
The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on standard front-end page views, allowing unauthenticated users to read the full contents of restricted posts and pages through other routes that render the same content.
PLUGIN
Subscriptions for WooCommerce
CVE-2026-87856
Risk Score
Threat Entry
Updated 2026-09-17
Subscriptions for WooCommerce - Security Vulnerability (CVE-2026-87854)
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and payment dates.
PLUGIN
Subscriptions for WooCommerce
CVE-2026-87854
Risk Score
Threat Entry
Updated 2026-09-17
Subscriptions for WooCommerce - Security Vulnerability (CVE-2026-87860)
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making.
PLUGIN
Subscriptions for WooCommerce
CVE-2026-87860
Risk Score
Threat Entry
Updated 2026-08-26
Subscriptions for WooCommerce - Improper Input Validation (CVE-2026-15211)
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is COMPLETED, without comparing the captured amount to the order total. This allows an attacker (unauthenticated where guest checkout is enabled) to substitute an approved, uncaptured PayPal order token and have an expensive order marked paid without paying its price.
PLUGIN
Subscriptions for WooCommerce
CVE-2026-15211
Risk Score
Threat Entry
Updated 2026-08-26
Subscriptions for WooCommerce - Remote Code Execution (CVE-2026-15215)
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) to install and activate arbitrary Subscriptions for WooCommerce WordPress plugin before 2.0.1, resulting in remote code execution.
PLUGIN
Subscriptions for WooCommerce
CVE-2026-15215
Risk Score
Threat Entry
Updated 2026-08-26
Subscriptions for WooCommerce - Security Vulnerability (CVE-2026-15214)
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information (the subscribed product, status, and dates) by supplying that subscription's ID.
PLUGIN
Subscriptions for WooCommerce
CVE-2026-15214
Risk Score
Threat Entry
Updated 2026-08-12
Subscriptions For Woocommerce - Privilege Escalation (CVE-2026-15414)
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the `save_meta_boxes()` function persisting the `_wps_plan_user_role` membership plan meta from `$_POST` without an allowlist that excludes privileged roles — the only validations applied, `sanitize_key()` and `wp_roles()->is_role()`, both accept `'administrator'` as a valid value, and the UI's `disabled` attribute on the role dropdown is a client-side-only control trivially bypassed via DevTools or a direct POST request; additionally, because the `wps_membership_plan` custom post type is registered with `capability_type =>…
PLUGIN
Subscriptions For Woocommerce
CVE-2026-15414
Risk Score
Threat Entry
Updated 2026-07-30
Subscriptions For Woocommerce - Broken Access Control (CVE-2026-15397)
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via the wps_sfw_install_plugin_configuration AJAX handler. This makes it possible for authenticated attackers, with shop manager-level access and above, to install and activate arbitrary WordPress.org plugins.
PLUGIN
Subscriptions For Woocommerce
CVE-2026-15397
Risk Score
Threat Entry
Updated 2026-06-29
Subscriptions for WooCommerce - Broken Access Control (CVE-2026-56061)
Unauthenticated Broken Access Control in Subscriptions for WooCommerce
PLUGIN
Subscriptions for WooCommerce
CVE-2026-56061
Risk Score
Threat Entry
Updated 2026-06-17
Subscriptions For Woocommerce - Authentication Bypass (CVE-2026-24372)
Authentication Bypass by Spoofing vulnerability in WP Swings Subscriptions for WooCommerce subscriptions-for-woocommerce allows Input Data Manipulation.This issue affects Subscriptions for WooCommerce: from n/a through
PLUGIN
Subscriptions For Woocommerce
CVE-2026-24372
Risk Score
Threat Entry
Updated 2026-06-17
Subscriptions For Woocommerce - Broken Access Control (CVE-2026-1926)
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `wps_sfw_admin_cancel_susbcription()` function in all versions up to, and including, 1.9.2. This is due to the function being hooked to the `init` action without any authentication or authorization checks, and only performing a non-empty check on the nonce parameter without actually validating it via `wp_verify_nonce()`. This makes it possible for unauthenticated attackers to cancel any active WooCommerce subscription by sending a crafted GET request with an arbitrary nonce value…
PLUGIN
Subscriptions For Woocommerce
CVE-2026-1926
Risk Score