Subscriptions for WooCommerce EUVD-2026-51687

Exploitation requires: (1) an attacker-controlled account with at minimum Contributor-level WordPress access - this is the capability needed to satisfy the current_user_can('edit_post', $post_id) check in save_meta_boxes(); (2) the Subscriptions for WooCommerce Pro companion plugin must be installed and active, as it is the exclusive component that reads _wps_plan_user_role via get_post_meta() and calls add_role() during membership lifecycle events - the free plugin alone stores the poisoned value but never applies it; (3) the attacker must be able to acquire a membership tied to the modified plan (purchase it, or if self-service registration is enabled, enroll). Limiting factors: the Pro plugin dependency is a hard gate - sites running only the free plugin cannot be exploited for the role-application impact. Exploitation is not possible by unauthenticated users. The wps_membership_plan CPT's capability_type => 'post' misconfiguration is what allows Contributors (not just Editors or Admins) to reach the vulnerable code path.

The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the network-accessible, low-complexity nature of the attack once a Contributor account exists. The key limiting signal not captured in the base score is the hard dependency on the Pro companion plugin being installed and active - without it, the poisoned meta is stored but never applied, meaning exploitation is blocked even if the free plugin is vulnerable. This dependency raises realistic attack complexity above what AC:L suggests in isolation. No EPSS data was supplied, and the vulnerability is not listed in the CISA KEV catalog, so there is no confirmed active exploitation. However, Wordfence's disclosure includes direct source-line references, making independent exploit development straightforward for any attacker with a test environment. The realistic priority is high for WordPress sites that run both the free Subscriptions for WooCommerce plugin AND the Pro companion, particularly multi-tenant or marketplace-style sites where untrusted Contributor accounts exist. Sites running only the free plugin are not exploitable for the full impact but should still patch to eliminate the stored-meta poisoning vector.

An attacker registers a Contributor-level account on a WordPress site running both the free and Pro Subscriptions for WooCommerce plugins. They navigate to edit or create a membership plan, then use browser DevTools (or a tool like Burp Suite) to remove the disabled attribute from the role dropdown and set its value to 'administrator' before submitting the form. The server-side save_meta_boxes() function stores 'administrator' as _wps_plan_user_role with no rejection; the attacker then acquires a membership tied to that plan (purchasing it or self-assigning), and the Pro plugin's lifecycle event handler calls add_role('administrator') on their account, granting full site administrative access.