What is the CVSS score of CVE-2026-15397?

CVE-2026-15397 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Subscriptions for WooCommerce are affected by CVE-2026-15397?

The WP Swings Subscriptions for WooCommerce plugin (versions ≤2.0.0) contains an authorization bypass that allows shop managers to install arbitrary WordPress plugins, bypassing normal administrative…

How to fix or mitigate CVE-2026-15397?

Within 24 hours, disable the WP Swings Subscriptions for WooCommerce plugin version 2.0.0 and all earlier versions, or implement strict role restrictions preventing all shop manager accounts from accessing plugin installation functions. Within 7 days, audit all currently installed plugins and review detailed shop manager account activity logs for any unauthorized plugin installations or suspicious behavior; identify and evaluate alternative subscription plugins without this vulnerability. Within 30 days, monitor the Wordfence advisory and WordPress plugin repository for a vendor security patch; if no patch is released within 90 days, execute migration to an alternative subscription solution and implement granular role-based access controls limiting shop manager capabilities to essential operations only.

Subscriptions for WooCommerce CVE-2026-15397

EUVD-2026-51089 HIGH

Missing Authorization (CWE-862)

2026-07-30 Wordfence

GHSA-36gg-fcqh-hw2c

WordPress Authentication Bypass Subscriptions For Woocommerce Wordpress Plugin Wpswings

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable AJAX with no user interaction (AV:N/AC:L/UI:N) but requires shop-manager privileges (PR:H); arbitrary plugin install enables full site compromise (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 11:52 vuln.today

CVE Published

Jul 30, 2026 - 11:03 cve.org

HIGH 7.2

DescriptionCVE.org

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via the wps_sfw_install_plugin_configuration AJAX handler. This makes it possible for authenticated attackers, with shop manager-level access and above, to install and activate arbitrary WordPress.org plugins.

AnalysisAI

Arbitrary plugin installation in the WP Swings Subscriptions for WooCommerce plugin (versions up to and including 2.0.0) lets authenticated users with shop manager privileges or higher install and activate any plugin from the WordPress.org repository through the wps_sfw_install_plugin_configuration AJAX handler, which performs no capability check (CWE-862). Because a shop manager is normally barred from managing plugins, this grants an unauthorized privileged capability that can be chained to full site compromise by installing a separately vulnerable plugin. Reported by Wordfence with a CVSS 7.2; no public exploit is identified at time of analysis and it is not on CISA KEV.

Technical ContextAI

The affected component is a WordPress/WooCommerce plugin (cpe:2.3:a:wpswings:subscriptions_for_woocommerce) that adds recurring-payment subscription functionality to WooCommerce stores. The flaw lives in an admin AJAX action, wps_sfw_install_plugin_configuration, registered through WordPress's admin-ajax.php mechanism (see admin/class-subscriptions-for-woocommerce-admin.php lines 1248 and 1271, and the main class-subscriptions-for-woocommerce.php at line 394). The root cause is CWE-862 Missing Authorization: the handler invokes WordPress plugin install/activate routines without calling current_user_can('install_plugins'/'activate_plugins') or an equivalent capability gate, so any role able to reach the endpoint can trigger privileged plugin management that WordPress otherwise reserves for administrators.

RemediationAI

Update the Subscriptions for WooCommerce plugin to a release later than 2.0.0 that adds the authorization check; a fix is reflected in the WordPress SVN changeset at http://plugins.trac.wordpress.org/changeset?reponame=&old=3624543%40subscriptions-for-woocommerce&new=3624543%40subscriptions-for-woocommerce, though a specific tagged patched version is not stated in the provided data, so confirm the exact fixed version against the Wordfence advisory before deploying. Where immediate patching is not possible, audit and minimize accounts holding the shop_manager role and any custom roles with equivalent capabilities, since those are the only accounts that can trigger the flaw; block or restrict the wps_sfw_install_plugin_configuration action on /wp-admin/admin-ajax.php at a WAF or reverse-proxy layer, noting this may break legitimate plugin-driven configuration flows; and enforce MFA on all shop-manager and administrator logins to reduce the chance of a hijacked account abusing the endpoint.