What is the CVSS score of EUVD-2026-54380?

EUVD-2026-54380 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Subscriptions for WooCommerce are affected by EUVD-2026-54380?

The Subscriptions for WooCommerce WordPress plugin before version 2.0.1 contains a vulnerability allowing anyone with Shop Manager credentials to execute arbitrary code and gain complete control over…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-54380?

Yes, a public proof-of-concept exploit is available for EUVD-2026-54380. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-54380?

Within 24 hours, inventory all WordPress installations and identify those running Subscriptions for WooCommerce with versions prior to 2.0.1. Within 7 days, upgrade all affected instances to version 2.0.1 or later. Within 30 days, audit Shop Manager account activity logs for suspicious plugin installations, implement least-privilege restrictions excluding Shop Managers from plugin management, and establish mandatory approval workflows for plugin modifications.

Subscriptions for WooCommerce EUVD-2026-54380

| CVE-2026-15215 HIGH

Improper Privilege Management (CWE-269)

2026-08-07 WPScan

GHSA-m77w-m8qm-q9pv

WordPress RCE Privilege Escalation Subscriptions For Woocommerce

8.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

AV:N for the standard admin-ajax.php endpoint; PR:L because a valid Shop Manager account is required; full C/I/A justified by arbitrary plugin execution enabling complete RCE.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 19:30 vuln.today

Patch available

Aug 07, 2026 - 07:01 EUVD

CVE Published

Aug 07, 2026 - 06:00 cve.org

HIGH 8.8

CVE Published

Aug 07, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) to install and activate arbitrary Subscriptions for WooCommerce WordPress plugin before 2.0.1, resulting in remote code execution.

AnalysisAI

Remote code execution in Subscriptions for WooCommerce WordPress plugin (before 2.0.1) is reachable by any authenticated Shop Manager through a missing capability check on a nonce-protected AJAX action that installs and activates arbitrary plugins from user-supplied slugs. Shop Managers, who by WordPress design are not granted plugin management capabilities, can exploit this gap to install a malicious plugin and achieve full server-side code execution. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain or compromise Shop Manager credentials

Delivery

Craft authenticated AJAX plugin-install request with malicious plugin slug

Exploit

Server installs and activates attacker-supplied plugin without capability check

Execution

Malicious PHP code executes under web server context

Impact

Full RCE and site compromise achieved

Access

Obtain or compromise Shop Manager credentials

Delivery

Craft authenticated AJAX plugin-install request with malicious plugin slug

Exploit

Server installs and activates attacker-supplied plugin without capability check

Execution

Malicious PHP code executes under web server context

Impact

Full RCE and site compromise achieved

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated WordPress session holding the Shop Manager role - a WooCommerce-specific role distinct from administrator and one that should not carry plugin management capabilities. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) accurately reflects technical severity: network-accessible endpoint, low complexity, and a full C/I/A impact triad driven by post-exploitation RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who holds or has compromised a Shop Manager account - a common role granted to store staff and third-party integrators in WooCommerce deployments - sends a crafted authenticated AJAX request to the WordPress admin-ajax.php endpoint, supplying the slug of a malicious plugin. Because the handler checks only the nonce and not the user's plugin-management capability, the server installs and activates the supplied plugin, executing the attacker's PHP payload with web server privileges. …
Remediation	Update the Subscriptions for WooCommerce plugin to version 2.0.1 or later immediately via the WordPress dashboard (Plugins > Installed Plugins > Update) or via WP-CLI using wp plugin update. … Detailed patch versions, workarounds, and compensating controls in full report.