Subscriptions for WooCommerce CVE-2026-87854

No special conditions beyond running the affected software: the site must have the Subscriptions for WooCommerce plugin (WPSwings) installed and active at a version before 2.0.3, with the vulnerable REST endpoint reachable over the network. Exploitation is remote and unauthenticated (PR:N/UI:N) against default configurations because the endpoint's shared-secret protection is validated incorrectly and can be bypassed without valid credentials. Limiting factors: impact is confined to reading subscription data (confidentiality only - no write, privilege gain, or takeover), the store must actually use the subscriptions feature to hold meaningful data, and the flaw is fixed by updating to 2.0.3.

Signals are internally consistent and point to a genuine but moderate-severity data-exposure issue rather than a critical one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) describes a network-reachable, low-complexity, fully unauthenticated flaw with confidentiality-only impact and no integrity or availability effect - appropriate for a broken access-control disclosure of aggregate customer PII. EPSS is low at 0.18% (8th percentile) and there is no CISA KEV listing, indicating no evidence of active or widespread exploitation. However, a public WPScan proof-of-concept exists, which raises the practical likelihood of opportunistic use against unpatched stores because the exploit is trivial (single crafted REST request, no auth, no user interaction). No signals conflict: the low EPSS alongside available POC is normal for a newly disclosed low-priority WordPress plugin bug - POC availability and exploitation probability are distinct, and low EPSS here reflects lack of observed mass exploitation, not lack of exploitability. Net: a real priority for stores handling recurring-billing customer data (privacy/GDPR exposure) but not a drop-everything critical, given confidentiality-only impact and no privilege or system compromise. The CPE lists vendor as 'unknown' and one tag is the placeholder 'Unknown' - metadata hygiene issues that do not affect the technical assessment.

An unauthenticated attacker sends a crafted request to the plugin's protected REST endpoint, where the shared-secret check is validated incorrectly and can be bypassed. The endpoint returns the store's complete subscription dataset - customer usernames, product names, recurring amounts and payment dates - exposing sensitive customer and revenue data. A public WPScan proof-of-concept exists, and because the flaw is remote, unauthenticated, and low-complexity (AV:N/AC:L/PR:N/UI:N), exploitation requires only a single HTTP request against a vulnerable store.