EUVD-2026-93270
GHSA-36j5-mfjr-7wrp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed WordPress plugin endpoint
-
DeliverySend crafted unauthenticated request
-
ExploitBypass missing authorization check
-
ExecutionInvoke privileged plugin function
-
ImpactAlter subscription/plugin data or disrupt service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires only that the Autoship Cloud for WooCommerce Subscription Products plugin at version 2.17.0 or earlier be installed and active on a network-reachable WordPress/WooCommerce site; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and default configurations are exploitable. The practical limiting factors are that a vulnerable version must be installed and the affected plugin endpoint must be reachable; impact is bounded to partial integrity and availability (C:N/I:L/A:L), so the flaw enables unauthorized actions on plugin/subscription functionality rather than data disclosure or full site compromise. Exploitation is closed by upgrading beyond 2.17.0 to the vendor-fixed release. |
| Impact | This is a moderate-risk issue rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity flaw requiring no privileges and no user interaction, which favors easy exploitation, but impact is capped at C:N/I:L/A:L - no confidentiality loss and only partial integrity/availability effects, consistent with the CWE-862 Missing Authorization / broken access control nature. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or weaponization; exploitation status is 'no public exploit identified at time of analysis.' SSVC-style reasoning: exploitation is not confirmed, technical impact is partial (not total), and automatability is plausible given the unauthenticated network vector but unverified. Net: easy-to-reach but limited-impact authorization flaw in a niche WordPress plugin - prioritize patching on affected sites, but it does not rise to the drop-everything level of an RCE or full-takeover bug. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted HTTP request directly to an exposed plugin endpoint that fails to verify the caller's authorization, invoking a function intended for privileged users. Because no login or user interaction is needed, the attacker can modify or trigger plugin/subscription data (partial integrity and availability impact) on any site running Autoship Cloud for WooCommerce <= 2.17.0. No public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated broken access control in the Autoship Cloud for WooCommerce Subscription Products plugin through version 2.17.0 lets remote attackers reach plugin functionality that should require authorization, allowing unauthorized actions that degrade the integrity and availability of subscription-related operations (CVSS 6.5, C:N/I:L/A:L). The assessed vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is exploitable without credentials or user interaction, so the only real prerequisites are that a vulnerable plugin version be installed, active, and reachable over the network on a WordPress/WooCommerce site. No CISA KEV entry and no public exploit code were identified at time of analysis, so this is a moderate, patch-on-schedule issue rather than a top-tier emergency.
RemediationAI
Upgrade the Autoship Cloud for WooCommerce Subscription Products plugin past 2.17.0 to the vendor-fixed release, which is the action that closes the missing-authorization path; Patch status: Patch available per vendor advisory, with the advisory and affected-version confirmation available at https://patchstack.com/database/wordpress/plugin/autoship-cloud/vulnerability/wordpress-autoship-cloud-for-woocommerce-subscription-products-plugin-2-17-0-broken-access-control-vulnerability. If the update cannot be applied immediately, deactivate the plugin on sites that do not use its subscription features (side effect: Autoship-based recurring orders, scheduled shipments and subscription management stop functioning), and on sites that do rely on it, use a WAF or reverse-proxy rule to block unauthenticated POST requests to the plugin's AJAX/REST endpoints and restrict access to those paths to trusted administrative IPs (side effect: legitimate customer-initiated subscription actions from the storefront may be blocked, so test against your checkout flow). Continue to monitor the vendor advisory for a confirmed fixed version number before assuming a specific build resolves the issue, and re-verify plugin version after any staged update rollout.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-862 (Missing Authorization): the plugin exposes functionality - order/subscription-related actions typical of Autoship Cloud's recurring-order and scheduled-shipment handling - through WordPress entry points (AJAX handlers and/or REST routes) that are not guarded by capability checks or nonce validation, so any network client can invoke them. The supplied CPE, cpe:2.3:a:patternsinthecloud:autoship_cloud_for_woocommerce_subscription_products, identifies the affected component as the Patterns in the Cloud plugin for WooCommerce; the version wildcard reflects that the advisory covers all releases up to and including 2.17.0 rather than a single build. Because the CVSS vector sets C:N, the exposure is not a data-disclosure primitive; the I:L/A:L components indicate an attacker can tamper with subscription state or interrupt subscription processing, but cannot escalate to full site compromise or read protected data through this flaw alone.
Know when Autoship Cloud For Woocommerce Subscription Products gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Missing authorization reachable remotely without credentials or interaction gives AV:N/AC:L/PR:N/UI:N; impact limited to partial integrity and availability with no data disclosure, so C:N/I:L/A:L.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in Autoship Cloud for WooCommerce Subscription Products <= 2.17.0 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB