Skip to main content

Subscriptions For Woocommerce CVE-2026-87854

| EUVDEUVD-2026-80208
2026-09-16 WPScan GHSA-mp62-wj23-fc7f
WordPress Information Disclosure Subscriptions For Woocommerce

Lifecycle Timeline

2
Patch available
Sep 16, 2026 - 07:01 EUVD
CVE Published
Sep 16, 2026 - 06:00 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and payment dates.

Analysis

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and payment dates.

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Subscriptions For Woocommerce

View all
CVE-2026-15215 HIGH POC
8.8 Aug 07

Remote code execution in Subscriptions for WooCommerce WordPress plugin (before 2.0.1) is reachable by any authenticated
CVE-2026-15211 MEDIUM POC
5.9 Aug 07

Payment integrity bypass in the Subscriptions for WooCommerce plugin (versions before 2.0.1) enables financial fraud by

CVE-2026-15414 HIGH
8.8 Aug 01

Privilege escalation in the Subscriptions for WooCommerce WordPress plugin (versions up to and including 2.0.0) allows a
CVE-2026-15214 MEDIUM POC
4.3 Aug 07

Insecure Direct Object Reference (IDOR) in the Subscriptions for WooCommerce WordPress plugin before 2.0.1 allows any au
CVE-2026-24372 HIGH
7.5 Mar 25

An authentication bypass vulnerability exists in WP Swings Subscriptions for WooCommerce plugin versions up to and inclu
CVE-2026-15397 HIGH
7.2 Jul 30

Arbitrary plugin installation in the WP Swings Subscriptions for WooCommerce plugin (versions up to and including 2.0.0)
CVE-2026-1926 MEDIUM
5.3 Mar 18

The Subscriptions for WooCommerce plugin contains a critical authentication bypass vulnerability in the subscription can
CVE-2026-87860 POC
Sep 16

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that c

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-87854 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy