CVE-2026-15211
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The Subscriptions for WooCommerce WordPress plugin before version 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow. It captures a client-supplied token and marks the order paid whenever the capture status is COMPLETED, without comparing the captured amount to the order total. This allows an attacker (unauthenticated where guest checkout is enabled) to substitute an approved, uncaptured PayPal order token and have an expensive order marked paid without paying its price.
Risk Assessment
An attacker can obtain products or services without paying, leading to financial losses. This may also undermine customer trust and order process integrity.
Recommendation
Update the Subscriptions for WooCommerce plugin to version 2.0.1 or later. Ensure payment validation is correctly configured.
Other vulnerabilities in Subscriptions for WooCommerce
See all- CVE-2026-15397High
The Subscriptions for WooCommerce plugin for WordPress (all versions up to and including 2.0.0) fails to properly verify user authorization in the wps_sfw_install_plugin_configuration AJAX handler, allowing authenticated attackers with shop manager-level access or higher to install and activate arbitrary WordPress.org plugins.
- CVE-2026-15414High
The Subscriptions for WooCommerce plugin for WordPress up to version 2.0.0 has a privilege escalation vulnerability. The save_meta_boxes() function saves the user role from POST without proper validation, and the 'wps_membership_plan' post type has capability_type 'post', allowing users with Contributor-level access and above to set the role to 'administrator'. Exploitation requires the Pro plugin to be active.
- CVE-2026-56061High
The Subscriptions for WooCommerce plugin version 1.9.5 and earlier contains a vulnerability allowing unauthenticated attackers to bypass access controls. This flaw enables unauthorized operations on subscriptions without requiring authentication.
Original NVD description (English source)
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is COMPLETED, without comparing the captured amount to the order total. This allows an attacker (unauthenticated where guest checkout is enabled) to substitute an approved, uncaptured PayPal order token and have an expensive order marked paid without paying its price.