EUVD-2026-54379
GHSA-qhjm-7mgh-6mhm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network vector confirmed; PR:L because a registered customer session is required; C:L reflects narrow subscription metadata disclosure with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information (the subscribed product, status, and dates) by supplying that subscription's ID.
AnalysisAI
Insecure Direct Object Reference (IDOR) in the Subscriptions for WooCommerce WordPress plugin before 2.0.1 allows any authenticated customer to read subscription records belonging to other customers by supplying an arbitrary subscription ID. The plugin fails to enforce ownership checks before returning subscription details - subscribed product, status, and date fields - exposing sensitive order metadata across tenant boundaries. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid authenticated customer session on the target WooCommerce store - specifically a registered user account with at least one prior subscription or the ability to register freely. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS score of 4.3 (Medium) is consistent with the actual impact: network-accessible, low complexity, requires authentication (PR:L), no user interaction, limited confidentiality disclosure only. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A threat actor registers a free or low-cost customer account on a WooCommerce store running a vulnerable plugin version. They then iterate through sequential subscription IDs in the subscription detail endpoint, collecting product names, subscription statuses, and billing cycle dates for all other customers. … |
| Remediation | Update the Subscriptions for WooCommerce plugin to version 2.0.1 or later, which is the vendor-released patch confirmed by WPScan (https://wpscan.com/vulnerability/d11cfec5-e1e6-4a01-84e2-4d42be1a72ac/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Subscriptions for WooCommerce WordPress plugin (before 2.0.1) is reachable by any authenticated
Payment integrity bypass in the Subscriptions for WooCommerce plugin (versions before 2.0.1) enables financial fraud by
Privilege escalation in the Subscriptions for WooCommerce WordPress plugin (versions up to and including 2.0.0) allows a
Arbitrary plugin installation in the WP Swings Subscriptions for WooCommerce plugin (versions up to and including 2.0.0)
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today