Subscriptions for WooCommerce CVE-2026-15211

The plugin must be using PayPal as the active payment gateway for WooCommerce, and the Subscriptions for WooCommerce plugin version must be below 2.0.1. For unauthenticated exploitation, WooCommerce guest checkout must be enabled (a common default configuration for many stores). If guest checkout is disabled, the attacker must possess a registered WooCommerce customer account (PR:L equivalent). In all cases, the attacker must independently obtain a valid PayPal order token with an approved but uncaptured status - for example, by initiating a separate low-value PayPal transaction through their own account. There is no requirement for network proximity, special system privileges, or user interaction from the victim merchant. Exploitation is limited to stores running both WooCommerce and this specific subscription plugin with PayPal enabled; stores using only other payment gateways (Stripe, direct bank, etc.) are not affected.

The NVD CVSS 3.1 score of 5.9 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N reflects that, while the attack is network-accessible and requires no authentication (when guest checkout is enabled), the attacker must independently possess a valid approved but uncaptured PayPal order token - raising attack complexity to High. Despite the medium CVSS, the real-world business impact is potentially severe: exploitation results in direct financial loss to merchants for every fraudulently completed order, and the attack is fully automated once a valid token is obtained. A publicly available proof-of-concept (per WPScan) significantly lowers the practical barrier, even for the token-sourcing step. No EPSS score was provided in the input data, so probability-of-exploitation-in-the-wild cannot be quantified from this dataset. The vulnerability is absent from the CISA KEV catalog, suggesting no confirmed mass exploitation at time of analysis, but the public POC and straightforward business logic nature make opportunistic fraud realistic. The 'Information Disclosure' tag in the source intelligence appears to be a mislabeling - the actual impact is financial integrity bypass with no confidentiality dimension, consistent with the CVSS C:N rating. WooCommerce subscription plugins are attractive targets for fraud, elevating priority beyond what raw CVSS alone indicates for affected merchants.

An attacker creates a minimal PayPal order - for example, a one-cent transaction - through their own PayPal account and obtains the resulting approved-but-uncaptured order token. They then add expensive items (e.g., a high-value subscription product) to the WooCommerce store, proceed to checkout as a guest, and on the order-received page inject the pre-obtained PayPal token in place of the token that would correspond to the actual order value. The plugin captures the supplied token, receives a COMPLETED status, and marks the full-price WooCommerce order as paid - granting subscription access or triggering fulfillment without the attacker paying the actual order total. A public POC is available, meaning the token substitution technique is documented and reproducible.