What is the CVSS score of CVE-2026-1926?

CVE-2026-1926 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Subscriptions For Woocommerce are affected by CVE-2026-1926?

Organizations using all should be aware of moderate risk from CVE-2026-1926, a missing authorization vulnerability rated CVSS 5.3. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-1926?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Subscriptions For Woocommerce CVE-2026-1926

EUVD-2026-12764 MEDIUM

Missing Authorization (CWE-862)

2026-03-18 Wordfence

WordPress Authentication Bypass Subscriptions For Woocommerce Wordpress Plugin Wpswings

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 18, 2026 - 04:30 euvd

EUVD-2026-12764

Analysis Generated

Mar 18, 2026 - 04:30 vuln.today

CVE Published

Mar 18, 2026 - 03:37 nvd

MEDIUM 5.3

DescriptionCVE.org

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wps_sfw_admin_cancel_susbcription() function in all versions up to, and including, 1.9.2. This is due to the function being hooked to the init action without any authentication or authorization checks, and only performing a non-empty check on the nonce parameter without actually validating it via wp_verify_nonce(). This makes it possible for unauthenticated attackers to cancel any active WooCommerce subscription by sending a crafted GET request with an arbitrary nonce value via the wps_subscription_id parameter.

AnalysisAI

The Subscriptions for WooCommerce plugin contains a critical authentication bypass vulnerability in the subscription cancellation function that allows unauthenticated attackers to cancel any active WooCommerce subscription. The vulnerability affects all versions up to and including 1.9.2 of the plugin (CPE: cpe:2.3:a:wpswings:subscriptions_for_woocommerce:*:*:*:*:*:*:*:*) and stems from a missing capability check combined with improper nonce validation. An attacker can exploit this with a simple GET request, requiring no special privileges or user interaction, resulting in unauthorized modification of subscription data with a CVSS score of 5.3 and confirmed active exploitation potential.

Technical ContextAI

The vulnerability resides in the WordPress plugin architecture where the wps_sfw_admin_cancel_susbcription() function is improperly hooked to the init action without adequate security controls. The root cause falls under CWE-862 (Missing Authorization), where the function performs only a non-empty check on the nonce parameter (isset() check) but fails to invoke the critical wp_verify_nonce() function required by WordPress security standards. The plugin is built for WooCommerce, a WordPress e-commerce framework, and the vulnerability allows manipulation of subscription data through the wps_subscription_id GET parameter. This represents a fundamental failure in the WordPress security model where admin-level operations must be protected by both authentication (ensuring the user is logged in) and authorization (ensuring the user has the manage_options or equivalent capability), neither of which are enforced here.

RemediationAI

Immediately upgrade the Subscriptions for WooCommerce plugin to version 1.9.3 or later, which includes proper nonce validation via wp_verify_nonce() and capability checks via current_user_can(). The patch is available through the WordPress plugin repository. For users unable to update immediately, implement a temporary workaround by disabling the plugin until patching is complete, as the vulnerability is unauthenticated and trivial to exploit. Additionally, site administrators should review WooCommerce subscription logs and audit trails for evidence of unauthorized cancellations during the vulnerability window, and consider implementing a Web Application Firewall (WAF) rule to block requests containing wps_subscription_id parameters from non-authenticated sessions. See Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/eabfdf29-eca9-4e4b-b809-23a83f5a91ac?source=cve for additional details and confirmation of patch deployment.