Subscriptions For Woocommerce
Monthly
Remote code execution in Subscriptions for WooCommerce WordPress plugin (before 2.0.1) is reachable by any authenticated Shop Manager through a missing capability check on a nonce-protected AJAX action that installs and activates arbitrary plugins from user-supplied slugs. Shop Managers, who by WordPress design are not granted plugin management capabilities, can exploit this gap to install a malicious plugin and achieve full server-side code execution. A publicly available proof-of-concept exists; however, EPSS is low (0.18%, 8th percentile) and the vulnerability is absent from CISA KEV, indicating exploitation remains opportunistic rather than widespread.
Privilege escalation in the Subscriptions for WooCommerce WordPress plugin (versions up to and including 2.0.0) allows authenticated Contributors to elevate their accounts to Administrator by poisoning a membership plan's stored role meta. The `save_meta_boxes()` function accepts the `_wps_plan_user_role` POST parameter with no server-side allowlist blocking privileged roles; the only guards applied - `sanitize_key()` and `wp_roles()->is_role()` - both pass 'administrator' as valid. Full exploitation requires the companion Pro plugin to be active, as it is the component that reads the stored meta and calls `add_role()` during membership lifecycle events. No public exploit has been identified at time of analysis, though Wordfence has published full technical detail and the vulnerable source lines are publicly browsable.
Arbitrary plugin installation in the WP Swings Subscriptions for WooCommerce plugin (versions up to and including 2.0.0) lets authenticated users with shop manager privileges or higher install and activate any plugin from the WordPress.org repository through the wps_sfw_install_plugin_configuration AJAX handler, which performs no capability check (CWE-862). Because a shop manager is normally barred from managing plugins, this grants an unauthorized privileged capability that can be chained to full site compromise by installing a separately vulnerable plugin. Reported by Wordfence with a CVSS 7.2; no public exploit is identified at time of analysis and it is not on CISA KEV.
An authentication bypass vulnerability exists in WP Swings Subscriptions for WooCommerce plugin versions up to and including 1.8.10, allowing attackers to manipulate input data to spoof authentication credentials and bypass access controls. This vulnerability affects WordPress installations using the affected plugin and could allow unauthenticated attackers to gain unauthorized access to subscription management functionality. While no CVSS score or EPSS data is currently available, the vulnerability has been documented by Patchstack and assigned EUVD-2026-15568, indicating active tracking by European vulnerability databases.
Cross-site request forgery in the WordPress plugin Subscriptions for WooCommerce before 2.0.3 allows an attacker to cancel a logged-in customer's active subscription by tricking that customer into loading a crafted request, because the cancellation handler does not verify a security token. The attacker needs no account of their own (PR:N) but must socially engineer a victim who is already authenticated and holds an active subscription, and the impact is confined to that victim's own subscription (S:U, C:N, I:L, A:N), yielding a modest CVSS 3.1 base score of 4.3. Publicly available exploit code exists per WPScan and the CVE record, though EPSS is only 0.14% (3rd percentile) and there is no confirmed active exploitation (CISA KEV). A vendor patch is available: updating to 2.0.3 adds the missing security-token verification.
Unauthenticated remote attackers can retrieve a WooCommerce store's complete subscription roster - customer usernames, product names, recurring amounts and payment dates - because the Subscriptions for WooCommerce plugin from WPSwings (all versions before 2.0.3) validates the shared secret protecting one of its REST endpoints incorrectly. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so exploitation requires no credentials or user interaction and is limited to confidentiality loss - no data modification, privilege escalation or account takeover - but the store must actually be using the plugin's subscriptions feature for meaningful data to be exposed. Publicly available exploit code exists (documented by WPScan), the CVE is not listed in CISA KEV, and EPSS is 0.18% (8th percentile), indicating low observed exploitation likelihood; the vendor has released a fixed version 2.0.3.
Payment integrity bypass in the Subscriptions for WooCommerce plugin (versions before 2.0.1) enables financial fraud by allowing substitution of an arbitrary approved PayPal order token during the WooCommerce order-received flow. The plugin captures a client-supplied token and marks any order paid solely based on a COMPLETED capture status, without verifying that the captured amount matches the order total or that the token belongs to the specific order. Unauthenticated attackers - where guest checkout is enabled - can exploit this to obtain goods or subscription access without paying the actual order price. A publicly available proof-of-concept exists; no CISA KEV listing at time of analysis.
Insecure Direct Object Reference (IDOR) in the Subscriptions for WooCommerce WordPress plugin before 2.0.1 allows any authenticated customer to read subscription records belonging to other customers by supplying an arbitrary subscription ID. The plugin fails to enforce ownership checks before returning subscription details - subscribed product, status, and date fields - exposing sensitive order metadata across tenant boundaries. A publicly available proof-of-concept exists per WPScan, but with an EPSS of 0.13% (3rd percentile) and no CISA KEV listing, mass exploitation is not currently observed.
The Subscriptions for WooCommerce plugin contains a critical authentication bypass vulnerability in the subscription cancellation function that allows unauthenticated attackers to cancel any active WooCommerce subscription. The vulnerability affects all versions up to and including 1.9.2 of the plugin (CPE: cpe:2.3:a:wpswings:subscriptions_for_woocommerce:*:*:*:*:*:*:*:*) and stems from a missing capability check combined with improper nonce validation. An attacker can exploit this with a simple GET request, requiring no special privileges or user interaction, resulting in unauthorized modification of subscription data with a CVSS score of 5.3 and confirmed active exploitation potential.
Remote code execution in Subscriptions for WooCommerce WordPress plugin (before 2.0.1) is reachable by any authenticated Shop Manager through a missing capability check on a nonce-protected AJAX action that installs and activates arbitrary plugins from user-supplied slugs. Shop Managers, who by WordPress design are not granted plugin management capabilities, can exploit this gap to install a malicious plugin and achieve full server-side code execution. A publicly available proof-of-concept exists; however, EPSS is low (0.18%, 8th percentile) and the vulnerability is absent from CISA KEV, indicating exploitation remains opportunistic rather than widespread.
Privilege escalation in the Subscriptions for WooCommerce WordPress plugin (versions up to and including 2.0.0) allows authenticated Contributors to elevate their accounts to Administrator by poisoning a membership plan's stored role meta. The `save_meta_boxes()` function accepts the `_wps_plan_user_role` POST parameter with no server-side allowlist blocking privileged roles; the only guards applied - `sanitize_key()` and `wp_roles()->is_role()` - both pass 'administrator' as valid. Full exploitation requires the companion Pro plugin to be active, as it is the component that reads the stored meta and calls `add_role()` during membership lifecycle events. No public exploit has been identified at time of analysis, though Wordfence has published full technical detail and the vulnerable source lines are publicly browsable.
Arbitrary plugin installation in the WP Swings Subscriptions for WooCommerce plugin (versions up to and including 2.0.0) lets authenticated users with shop manager privileges or higher install and activate any plugin from the WordPress.org repository through the wps_sfw_install_plugin_configuration AJAX handler, which performs no capability check (CWE-862). Because a shop manager is normally barred from managing plugins, this grants an unauthorized privileged capability that can be chained to full site compromise by installing a separately vulnerable plugin. Reported by Wordfence with a CVSS 7.2; no public exploit is identified at time of analysis and it is not on CISA KEV.
An authentication bypass vulnerability exists in WP Swings Subscriptions for WooCommerce plugin versions up to and including 1.8.10, allowing attackers to manipulate input data to spoof authentication credentials and bypass access controls. This vulnerability affects WordPress installations using the affected plugin and could allow unauthenticated attackers to gain unauthorized access to subscription management functionality. While no CVSS score or EPSS data is currently available, the vulnerability has been documented by Patchstack and assigned EUVD-2026-15568, indicating active tracking by European vulnerability databases.
Cross-site request forgery in the WordPress plugin Subscriptions for WooCommerce before 2.0.3 allows an attacker to cancel a logged-in customer's active subscription by tricking that customer into loading a crafted request, because the cancellation handler does not verify a security token. The attacker needs no account of their own (PR:N) but must socially engineer a victim who is already authenticated and holds an active subscription, and the impact is confined to that victim's own subscription (S:U, C:N, I:L, A:N), yielding a modest CVSS 3.1 base score of 4.3. Publicly available exploit code exists per WPScan and the CVE record, though EPSS is only 0.14% (3rd percentile) and there is no confirmed active exploitation (CISA KEV). A vendor patch is available: updating to 2.0.3 adds the missing security-token verification.
Unauthenticated remote attackers can retrieve a WooCommerce store's complete subscription roster - customer usernames, product names, recurring amounts and payment dates - because the Subscriptions for WooCommerce plugin from WPSwings (all versions before 2.0.3) validates the shared secret protecting one of its REST endpoints incorrectly. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so exploitation requires no credentials or user interaction and is limited to confidentiality loss - no data modification, privilege escalation or account takeover - but the store must actually be using the plugin's subscriptions feature for meaningful data to be exposed. Publicly available exploit code exists (documented by WPScan), the CVE is not listed in CISA KEV, and EPSS is 0.18% (8th percentile), indicating low observed exploitation likelihood; the vendor has released a fixed version 2.0.3.
Payment integrity bypass in the Subscriptions for WooCommerce plugin (versions before 2.0.1) enables financial fraud by allowing substitution of an arbitrary approved PayPal order token during the WooCommerce order-received flow. The plugin captures a client-supplied token and marks any order paid solely based on a COMPLETED capture status, without verifying that the captured amount matches the order total or that the token belongs to the specific order. Unauthenticated attackers - where guest checkout is enabled - can exploit this to obtain goods or subscription access without paying the actual order price. A publicly available proof-of-concept exists; no CISA KEV listing at time of analysis.
Insecure Direct Object Reference (IDOR) in the Subscriptions for WooCommerce WordPress plugin before 2.0.1 allows any authenticated customer to read subscription records belonging to other customers by supplying an arbitrary subscription ID. The plugin fails to enforce ownership checks before returning subscription details - subscribed product, status, and date fields - exposing sensitive order metadata across tenant boundaries. A publicly available proof-of-concept exists per WPScan, but with an EPSS of 0.13% (3rd percentile) and no CISA KEV listing, mass exploitation is not currently observed.
The Subscriptions for WooCommerce plugin contains a critical authentication bypass vulnerability in the subscription cancellation function that allows unauthenticated attackers to cancel any active WooCommerce subscription. The vulnerability affects all versions up to and including 1.9.2 of the plugin (CPE: cpe:2.3:a:wpswings:subscriptions_for_woocommerce:*:*:*:*:*:*:*:*) and stems from a missing capability check combined with improper nonce validation. An attacker can exploit this with a simple GET request, requiring no special privileges or user interaction, resulting in unauthorized modification of subscription data with a CVSS score of 5.3 and confirmed active exploitation potential.