Subscriptions For Woocommerce CVE-2026-24372

WP Swings Subscriptions for WooCommerce plugin versions <= 1.8.10 installed and activated on WordPress. Remote unauthenticated attacker can manipulate input data to bypass authentication and access subscription data. No victim interaction required.

Without a CVSS vector or EPSS score, assessment relies on the vulnerability's structural characteristics and reported context. CWE-290 (Authentication by Spoofing) is classified as a high-severity weakness category, as successful exploitation directly compromises authentication integrity. The attack vector is likely network-based given the WordPress/WooCommerce plugin environment, and privileges required are probably none (unauthenticated attack). The presence of this vulnerability in a subscription management plugin amplifies real-world risk, as it could enable attackers to access subscription data, modify subscription states, or fraudulently create subscriptions without payment. The vulnerability's inclusion in the Patchstack database and assignment of an EUVD ID (EUVD-2026-15568) indicates confirmed validation by security researchers. However, the absence of public POC code, CVSS scoring, and KEV status designation suggests either recent disclosure or limited public exploitation. Given the plugin's function (subscription billing) and the authentication bypass nature, this should be treated as a priority vulnerability requiring immediate patching despite the lack of quantitative scoring data.

An attacker sends a crafted HTTP request to a WooCommerce site using the vulnerable Subscriptions for WooCommerce plugin, manipulating subscription-related parameters (such as user ID, subscription status, or subscription metadata) to bypass authentication checks and gain unauthorized access to a victim's subscription or administrative subscription management functions. Because the vulnerability involves input data manipulation rather than cryptographic weaknesses, the attack complexity is low, and the attacker can potentially execute this by modifying POST/GET parameters in a standard web request without needing valid credentials or special tools. An unauthenticated attacker could change another user's subscription status, access billing information, or create fraudulent subscription records without triggering authentication prompts.