What is the CVSS score of CVE-2026-24372?

CVE-2026-24372 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Subscriptions For Woocommerce are affected by CVE-2026-24372?

CVE-2026-24372 presents notable security risk rated CVSS 7.5. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-24372?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Subscriptions For Woocommerce CVE-2026-24372

EUVD-2026-15568 HIGH

Authentication Bypass by Spoofing (CWE-290)

2026-03-25 Patchstack

WordPress Authentication Bypass Subscriptions For Woocommerce Wordpress Plugin Wp Swings

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15568

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 7.5

DescriptionCVE.org

Authentication Bypass by Spoofing vulnerability in WP Swings Subscriptions for WooCommerce subscriptions-for-woocommerce allows Input Data Manipulation.This issue affects Subscriptions for WooCommerce: from n/a through <= 1.8.10.

AnalysisAI

An authentication bypass vulnerability exists in WP Swings Subscriptions for WooCommerce plugin versions up to and including 1.8.10, allowing attackers to manipulate input data to spoof authentication credentials and bypass access controls. This vulnerability affects WordPress installations using the affected plugin and could allow unauthenticated attackers to gain unauthorized access to subscription management functionality. While no CVSS score or EPSS data is currently available, the vulnerability has been documented by Patchstack and assigned EUVD-2026-15568, indicating active tracking by European vulnerability databases.

Technical ContextAI

The vulnerability is rooted in CWE-290 (Authentication by Spoofing), which represents improper verification of authentication mechanisms where user-controlled input is insufficiently validated before being used for authentication decisions. In the context of WP Swings Subscriptions for WooCommerce (CPE: cpe:2.3:a:wp_swings:subscriptions_for_woocommerce:*:*:*:*:*:*:*:*), the plugin fails to properly sanitize and validate authentication-related input data, specifically subscription-related parameters. This allows attackers to manipulate requests to the plugin's authentication handlers, bypassing the legitimate credential verification process that should govern access to subscription management features. The vulnerability likely resides in custom authentication hooks or validation functions that process subscription-related requests without adequate nonce verification, capability checks, or input sanitization.

RemediationAI

Update the WP Swings Subscriptions for WooCommerce plugin to a version later than 1.8.10 immediately via the WordPress plugin management interface or directly from the plugin repository. Verify that version 1.8.11 or later is installed, as this should contain the authentication validation fixes. Until patching is completed, implement WordPress security measures including: enforcing strong user account passwords and two-factor authentication on administrator accounts, restricting direct access to WooCommerce subscription management pages via .htaccess or WAF rules, and monitoring access logs for suspicious requests to subscription-related endpoints. Review subscription modification audit logs to detect any unauthorized changes made during the vulnerability window. For detailed patch information and confirmation of fix availability, consult the Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Plugin/subscriptions-for-woocommerce/vulnerability/wordpress-subscriptions-for-woocommerce-plugin-1-8-10-bypass-vulnerability-vulnerability.