Subscriptions for WooCommerce CVE-2026-15215

Exploitation requires an authenticated WordPress session holding the Shop Manager role - a WooCommerce-specific role distinct from administrator and one that should not carry plugin management capabilities. The target site must have the Subscriptions for WooCommerce plugin installed and active in a version below 2.0.1, and the WordPress admin-ajax.php endpoint must be network-reachable by the attacker. Exploitation is bounded by: (1) mandatory Shop Manager authentication - unauthenticated or Subscriber/Customer-role users cannot trigger the vulnerable action; (2) the attacker must supply a reachable plugin slug, meaning either a plugin on WordPress.org or a plugin on an attacker-controlled server depending on the server's outbound connectivity; (3) SSVC Automatable: No confirms the account-acquisition step prevents fully automated mass exploitation. Sites where every Shop Manager account is tightly controlled by internal, fully trusted personnel face meaningfully reduced realistic risk despite the high CVSS score.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) accurately reflects technical severity: network-accessible endpoint, low complexity, and a full C/I/A impact triad driven by post-exploitation RCE. However, real-world priority is tempered by several signals. EPSS sits at 0.18% (8th percentile), a low exploitation probability despite POC availability from WPScan - suggesting the threat is not yet being incorporated into automated attack tooling at scale. SSVC classifies this as Automatable: No, confirming that exploitation cannot be scripted end-to-end because it requires a valid Shop Manager account that must be obtained through prior compromise or social engineering. SSVC Technical Impact is Total, consistent with full RCE. For multi-operator WooCommerce stores where Shop Manager credentials are shared with staff, contractors, or third-party service providers, this vulnerability represents a meaningful insider threat or post-credential-theft escalation path. Single-operator stores with no externally shared accounts face substantially lower practical risk.

An attacker who holds or has compromised a Shop Manager account - a common role granted to store staff and third-party integrators in WooCommerce deployments - sends a crafted authenticated AJAX request to the WordPress admin-ajax.php endpoint, supplying the slug of a malicious plugin. Because the handler checks only the nonce and not the user's plugin-management capability, the server installs and activates the supplied plugin, executing the attacker's PHP payload with web server privileges. A public proof-of-concept documented by WPScan lowers the technical barrier to exploitation.