CVE-2026-15397
HighCVSS 7.2Summary
The Subscriptions for WooCommerce plugin for WordPress (all versions up to and including 2.0.0) fails to properly verify user authorization in the wps_sfw_install_plugin_configuration AJAX handler, allowing authenticated attackers with shop manager-level access or higher to install and activate arbitrary WordPress.org plugins.
Risk Assessment
An attacker can install malicious plugins, potentially taking over the WordPress site.
Recommendation
Update the Subscriptions for WooCommerce plugin to the latest available version (above 2.0.0).
Other vulnerabilities in Subscriptions for WooCommerce
See all- CVE-2026-15211Medium
The Subscriptions for WooCommerce WordPress plugin before version 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow. It captures a client-supplied token and marks the order paid whenever the capture status is COMPLETED, without comparing the captured amount to the order total. This allows an attacker (unauthenticated where guest checkout is enabled) to substitute an approved, uncaptured PayPal order token and have an expensive order marked paid without paying its price.
- CVE-2026-15414High
The Subscriptions for WooCommerce plugin for WordPress up to version 2.0.0 has a privilege escalation vulnerability. The save_meta_boxes() function saves the user role from POST without proper validation, and the 'wps_membership_plan' post type has capability_type 'post', allowing users with Contributor-level access and above to set the role to 'administrator'. Exploitation requires the Pro plugin to be active.
- CVE-2026-56061High
The Subscriptions for WooCommerce plugin version 1.9.5 and earlier contains a vulnerability allowing unauthenticated attackers to bypass access controls. This flaw enables unauthorized operations on subscriptions without requiring authentication.
Original NVD description (English source)
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via the wps_sfw_install_plugin_configuration AJAX handler. This makes it possible for authenticated attackers, with shop manager-level access and above, to install and activate arbitrary WordPress.org plugins.