EUVD-2026-51089
GHSA-36gg-fcqh-hw2c
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable AJAX with no user interaction (AV:N/AC:L/UI:N) but requires shop-manager privileges (PR:H); arbitrary plugin install enables full site compromise (C:H/I:H/A:H).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via the wps_sfw_install_plugin_configuration AJAX handler. This makes it possible for authenticated attackers, with shop manager-level access and above, to install and activate arbitrary WordPress.org plugins.
AnalysisAI
Arbitrary plugin installation in the WP Swings Subscriptions for WooCommerce plugin (versions up to and including 2.0.0) lets authenticated users with shop manager privileges or higher install and activate any plugin from the WordPress.org repository through the wps_sfw_install_plugin_configuration AJAX handler, which performs no capability check (CWE-862). Because a shop manager is normally barred from managing plugins, this grants an unauthorized privileged capability that can be chained to full site compromise by installing a separately vulnerable plugin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with the shop_manager role or higher (PR:H) on a site running Subscriptions for WooCommerce 2.0.0 or earlier with WooCommerce active; the attacker sends a request to the wps_sfw_install_plugin_configuration admin-AJAX action, which installs and activates a plugin without a capability check. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2 High) is internally consistent with the description: a network-reachable AJAX endpoint, low complexity, no user interaction, but PR:H because the attacker must already hold shop-manager or higher access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who obtains shop-manager credentials - through phishing, credential reuse, or an over-privileged staff account - sends a crafted POST to admin-ajax.php invoking wps_sfw_install_plugin_configuration to install and activate a WordPress.org plugin that carries a known exploitable vulnerability. They then abuse that newly installed plugin to gain code execution or administrator access, escalating from limited store management to full site takeover. … |
| Remediation | Update the Subscriptions for WooCommerce plugin to a release later than 2.0.0 that adds the authorization check; a fix is reflected in the WordPress SVN changeset at http://plugins.trac.wordpress.org/changeset?reponame=&old=3624543%40subscriptions-for-woocommerce&new=3624543%40subscriptions-for-woocommerce, though a specific tagged patched version is not stated in the provided data, so confirm the exact fixed version against the Wordfence advisory before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, disable the WP Swings Subscriptions for WooCommerce plugin version 2.0.0 and all earlier versions, or implement strict role restrictions preventing all shop manager accounts from accessing plugin installation functions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today