Subscriptions for WooCommerce CVE-2026-15214

The attacker must hold a valid authenticated customer session on the target WooCommerce store - specifically a registered user account with at least one prior subscription or the ability to register freely. No administrative privileges are required. The subscription ID parameter must be user-controllable (typical in WooCommerce REST or front-end endpoints). Exploitation is limited to reading subscription metadata (product, status, dates) and does not affect integrity or availability. Stores that do not permit open customer registration, or that require invitation-only accounts, significantly reduce the practical attack surface. The vulnerability does not affect unauthenticated visitors.

The NVD CVSS score of 4.3 (Medium) is consistent with the actual impact: network-accessible, low complexity, requires authentication (PR:L), no user interaction, limited confidentiality disclosure only. EPSS at 0.13% in the 3rd percentile suggests this is not being actively exploited at scale, which aligns with the fact it is not in CISA KEV. However, a publicly available exploit reference exists via WPScan (marked as exploit-class), meaning the bar for opportunistic abuse is low for authenticated users on vulnerable stores. The disclosed data - product name, subscription status, start/end dates - is meaningful for competitive intelligence or targeted social engineering but does not expose payment card data or credentials, which limits downstream blast radius. The primary risk is to stores with large subscriber bases where unauthorized enumeration could leak business-sensitive subscription metadata. The mismatch between low EPSS and the available POC suggests targeted rather than automated exploitation.

A threat actor registers a free or low-cost customer account on a WooCommerce store running a vulnerable plugin version. They then iterate through sequential subscription IDs in the subscription detail endpoint, collecting product names, subscription statuses, and billing cycle dates for all other customers. A publicly available proof-of-concept from WPScan lowers the technical barrier to this enumeration.