CVE-2026-24527
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Missing authorization in the Autoship Cloud for WooCommerce Subscription Products plugin allows exploiting incorrectly configured access control security levels. This vulnerability affects versions from n/a through 2.14.0.
Risk Assessment
An attacker can unauthorizedly modify subscriptions or access sensitive customer data, threatening the security of the WooCommerce store.
Recommendation
Update the Autoship Cloud for WooCommerce Subscription Products plugin to the latest version.
Other vulnerabilities in Autoship Cloud for WooCommerce Subscription Products
See all- CVE-2026-39762Medium
The Missing Authorization vulnerability in the Autoship Cloud for WooCommerce Subscription Products (autoship-cloud) plugin allows exploiting incorrectly configured access control security levels. This issue affects versions from n/a through 2.17.1.
- CVE-2024-13461Medium
The Autoship Cloud for WooCommerce Subscription Products plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'autoship-create-scheduled-order-action' shortcode in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Original NVD description (English source)
Missing Authorization vulnerability in Patterns in the cloud Autoship Cloud for WooCommerce Subscription Products allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.14.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS