What is the CVSS score of CVE-2026-56061?

CVE-2026-56061 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of WordPress are affected by CVE-2026-56061?

The Subscriptions for WooCommerce plugin (versions 1.9.5 and earlier) contains an authorization bypass that allows unauthenticated attackers to modify subscription data, directly exposing recurring…

How to fix or mitigate CVE-2026-56061?

Within 24 hours: Audit all WordPress instances for Subscriptions for WooCommerce plugin; disable plugin immediately if version 1.9.5 or earlier is detected. Within 7 days: Evaluate vendor mitigation guidance and alternative subscription platforms; implement WAF rules to restrict unauthenticated POST/PUT requests to subscription endpoints if continued operation is required. Within 30 days: Monitor vendor advisory for patch availability; upgrade to patched version once released; conduct data integrity audit of all subscription records for unauthorized modifications during exposure period.

WordPress CVE-2026-56061

EUVD-2026-39715 HIGH

Missing Authorization (CWE-862)

2026-06-26 audit@patchstack.com

GHSA-cw24-gr2q-5j2r

WordPress Authentication Bypass

7.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (patchstack) · only source for this CVE.

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:59 vuln.today

CVE Published

Jun 26, 2026 - 15:16 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions.

Articles & Coverage 1

News 11 New WordPress Vulnerabilities - 1 Critical, 10 High, 2 With POC Jun 27, 2026

AnalysisAI

Improper authorization in the Subscriptions for WooCommerce WordPress plugin (versions 1.9.5 and earlier) lets unauthenticated remote attackers reach functionality that should be access-restricted, enabling unauthorized modification of subscription data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, no-authentication, low-complexity abuse with a high integrity impact but no confidentiality or availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.