CVE-2026-15414
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
The Subscriptions for WooCommerce plugin for WordPress up to version 2.0.0 has a privilege escalation vulnerability. The save_meta_boxes() function saves the user role from POST without proper validation, and the 'wps_membership_plan' post type has capability_type 'post', allowing users with Contributor-level access and above to set the role to 'administrator'. Exploitation requires the Pro plugin to be active.
Risk Assessment
An authenticated attacker with low privileges can gain full administrator rights, taking over the WordPress site.
Recommendation
Update the Subscriptions for WooCommerce plugin to version 2.0.1 or later if available. In the meantime, restrict post editing access to trusted users only.
Other vulnerabilities in Subscriptions for WooCommerce
See all- CVE-2026-15397High
The Subscriptions for WooCommerce plugin for WordPress (all versions up to and including 2.0.0) fails to properly verify user authorization in the wps_sfw_install_plugin_configuration AJAX handler, allowing authenticated attackers with shop manager-level access or higher to install and activate arbitrary WordPress.org plugins.
- CVE-2026-15211Medium
The Subscriptions for WooCommerce WordPress plugin before version 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow. It captures a client-supplied token and marks the order paid whenever the capture status is COMPLETED, without comparing the captured amount to the order total. This allows an attacker (unauthenticated where guest checkout is enabled) to substitute an approved, uncaptured PayPal order token and have an expensive order marked paid without paying its price.
- CVE-2026-56061High
The Subscriptions for WooCommerce plugin version 1.9.5 and earlier contains a vulnerability allowing unauthenticated attackers to bypass access controls. This flaw enables unauthorized operations on subscriptions without requiring authentication.
Original NVD description (English source)
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the `save_meta_boxes()` function persisting the `_wps_plan_user_role` membership plan meta from `$_POST` without an allowlist that excludes privileged roles — the only validations applied, `sanitize_key()` and `wp_roles()->is_role()`, both accept `'administrator'` as a valid value, and the UI's `disabled` attribute on the role dropdown is a client-side-only control trivially bypassed via DevTools or a direct POST request; additionally, because the `wps_membership_plan` custom post type is registered with `capability_type => 'post'`, any user who can edit posts satisfies the `current_user_can('edit_post', $post_id)` guard in `save_meta_boxes()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their privileges to Administrator by storing `'administrator'` as the role granted on membership acquisition, which the Pro companion plugin then applies via `add_role()` during membership lifecycle events. Successful exploitation requires the Subscriptions for WooCommerce Pro companion plugin to be active, as it is the component that reads the stored `_wps_plan_user_role` meta via `get_post_meta()` and calls `add_role()` to apply the role during membership lifecycle events.