EUVD-2026-80209
GHSA-4q57-7phr-hqc4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted cancel-subscription request
-
DeliveryLure logged-in customer to click
-
ExploitVictim browser submits with valid session
-
ExecutionPlugin skips nonce check
-
ImpactActive subscription cancelled
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an already-authenticated WooCommerce customer with an active subscription who is tricked into loading an attacker-crafted request (UI:R) - the attacker themselves needs no account (PR:N). The vulnerable behavior is present in default configurations of Subscriptions for WooCommerce before 2.0.3 wherever the subscription-cancel feature is reachable. Limiting factors: the impact is confined to the individual victim's own subscription (no cross-user or admin impact, S:U, C:N/A:N), it requires social engineering/user interaction to deliver, and it is fully remediated by updating to 2.0.3, which adds the missing security-token verification. |
| Impact | This is a genuinely LOW-priority issue whose signals are internally consistent. The CVSS 4.3 (Medium) vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N describes a classic CSRF: PR:N because the attacker is unauthenticated, but UI:R because a logged-in customer must be tricked into triggering the crafted request, and impact is limited to I:L (integrity - one subscription flips to cancelled) with no confidentiality or availability loss. EPSS is very low at 0.14% (3rd percentile) and there is no CISA KEV listing, so exploitation is neither predicted nor observed at scale; publicly available exploit code exists (WPScan) but POC availability is a distinct signal from active exploitation and must not be conflated with it. The realistic ceiling is nuisance-level, self-inflicted damage limited to victims who click an attacker link while logged into their WooCommerce account - not mass exploitation. Note the CWE-862 (Missing Authorization) mapping under-describes the mechanism, which is really CWE-352 (missing nonce/CSRF token); this does not change the risk but is worth verifying against the WPScan advisory. |
| Exploit ScenarioDerived | An attacker crafts a page or email containing an auto-submitting request to the plugin's subscription-cancel endpoint and lures a store's logged-in customer into loading it; because no security token (nonce) is verified, the victim's authenticated browser session executes the cancellation of their own active subscription. Publicly available exploit code exists (WPScan), and because attack complexity is low the request is trivial to reproduce, though it only works against an already-authenticated customer who takes the bait. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Cross-site request forgery in the WordPress plugin Subscriptions for WooCommerce before 2.0.3 allows an attacker to cancel a logged-in customer's active subscription by tricking that customer into loading a crafted request, because the cancellation handler does not verify a security token. The attacker needs no account of their own (PR:N) but must socially engineer a victim who is already authenticated and holds an active subscription, and the impact is confined to that victim's own subscription (S:U, C:N, I:L, A:N), yielding a modest CVSS 3.1 base score of 4.3. Publicly available exploit code exists per WPScan and the CVE record, though EPSS is only 0.14% (3rd percentile) and there is no confirmed active exploitation (CISA KEV). A vendor patch is available: updating to 2.0.3 adds the missing security-token verification.
RemediationAI
Vendor-released patch: update the Subscriptions for WooCommerce plugin to version 2.0.3, which adds the missing security-token verification on the subscription-cancellation request; this is the only complete fix and should be applied through the WordPress plugin updater or by reinstalling the plugin package at 2.0.3 or later, as documented in the WPScan advisory (https://wpscan.com/vulnerability/de479136-1b41-4bb1-b660-9fd662eb666e/) and the NVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-87860). If immediate patching is not possible, the practical compensating control is to disable customer-initiated subscription cancellation - for example by removing the cancel action from the customer account/subscription templates or restricting cancellation to administrators - which fully removes the vulnerable request path but has the side effect of forcing customers to contact support and increasing administrative workload. A WAF rule or request filter that rejects cancellation requests lacking a valid nonce, or that blocks the specific cancel action endpoint from cross-origin referrers, can reduce exposure but is bypassable and should not be treated as a substitute for upgrading; likewise, tightening cookie SameSite attributes reduces (but does not eliminate) the CSRF delivery path and can break legitimate cross-site flows such as embedded checkout redirects. Because exploitation requires an authenticated customer with an active subscription to be tricked into loading an attacker-supplied request, user awareness of unsolicited links is a useful but secondary layer.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the WordPress plugin 'Subscriptions for WooCommerce', a storefront extension that lets customers self-manage recurring subscription records tied to a WooCommerce account. The vulnerability maps to CWE-862 (Missing Authorization) in the form of a missing WordPress nonce/security-token check on the request that cancels a subscription - the server trusts the request's authenticated session cookie alone rather than validating an anti-CSRF token bound to that session. Because the cancellation action is reachable in default configurations wherever the subscription-cancel feature is exposed, any site running the plugin below 2.0.3 with customer-initiated cancellation enabled carries the flaw. The CPE feed is incomplete (cpe:2.3:a:unknown:subscriptions_for_woocommerce:*:*:*:*:*:*:*:*, vendor recorded as 'unknown'), so version-range matching should be driven by the advisory data (EUVD lists 'Subscriptions for WooCommerce 0 < 2.0.3') rather than by CPE alone. The classic exploitation pattern is a state-changing GET/POST triggered from an attacker-controlled page while the victim's WooCommerce session cookie is sent automatically, which is why the CVSS vector carries UI:R rather than requiring attacker credentials.
Know when Subscriptions For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Unauthenticated attacker (PR:N) but the logged-in victim must be tricked into the request (UI:R); impact is limited integrity to the victim's own subscription (I:L), no confidentiality or availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Remote code execution in Subscriptions for WooCommerce WordPress plugin (before 2.0.1) is reachable by any authenticated
Payment integrity bypass in the Subscriptions for WooCommerce plugin (versions before 2.0.1) enables financial fraud by
Unauthenticated remote attackers can retrieve a WooCommerce store's complete subscription roster - customer usernames, p
Privilege escalation in the Subscriptions for WooCommerce WordPress plugin (versions up to and including 2.0.0) allows a
Insecure Direct Object Reference (IDOR) in the Subscriptions for WooCommerce WordPress plugin before 2.0.1 allows any au
An authentication bypass vulnerability exists in WP Swings Subscriptions for WooCommerce plugin versions up to and inclu
Arbitrary plugin installation in the WP Swings Subscriptions for WooCommerce plugin (versions up to and including 2.0.0)
The Subscriptions for WooCommerce plugin contains a critical authentication bypass vulnerability in the subscription can
Exploit-DB