Flexible Subscriptions EUVD-2026-97297

Requires a valid authenticated session on the target WordPress/WooCommerce site (PR:L), consistent with the plugin's user model (e.g., a registered customer/subscriber account); fully anonymous exploitation is not supported by the CVSS vector. Exploitation targets a Flexible Subscriptions plugin action that lacks a proper capability/authorization check, affecting versions from an unspecified start through 1.8.4. Limiting factors: an attacker must first obtain or register a low-privilege account, impact is confined to partial integrity (no data disclosure and no denial of service), and scope is unchanged (S:U). No specific non-default configuration is named in the advisory; the condition is the presence of the vulnerable plugin version with user registration/login enabled.

This is a moderate-risk, not a priority, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3 Medium) indicates a network-reachable, low-complexity flaw requiring low-level authentication (PR:L) and no user interaction, with impact limited to partial integrity (I:L) and no confidentiality or availability effect. This aligns with CWE-862 (Missing Authorization): an authenticated low-privilege user can invoke an action they should not be allowed to, modifying some data. There is NO CISA KEV listing and NO public exploit identified, so there are no active-exploitation or POC signals to elevate it. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. No SSVC decision data was supplied. The requirement for valid authentication (PR:L) plus the integrity-only, scope-unchanged impact substantially limits real-world severity; this looks like a typical authorization gap exploitable by existing users (e.g., subscribers/customers) rather than anonymous attackers. Note: the input Tag 'Authentication Bypass' conflicts with the CWE-862 classification and the referenced Patchstack title ('broken access control') - this is an authorization flaw for an already-authenticated user, not an authentication bypass; treat the tag as imprecise.

An attacker who already holds a low-privilege authenticated account (such as a customer or subscriber on a WooCommerce store running Flexible Subscriptions ≤1.8.4) sends a crafted request to a plugin endpoint that fails to verify the caller's authorization, allowing them to alter subscription-related data they should not control. No user interaction or elevated privileges are needed, but a valid login is required. No public proof-of-concept was identified at time of analysis.