CVE-2026-39762
MediumCVSS 6.5Summary
The Missing Authorization vulnerability in the Autoship Cloud for WooCommerce Subscription Products (autoship-cloud) plugin allows exploiting incorrectly configured access control security levels. This issue affects versions from n/a through 2.17.1.
Risk Assessment
An attacker can exploit the missing authorization to gain unauthorized access to functions or data, potentially leading to system integrity compromise or unauthorized actions.
Recommendation
Update the Autoship Cloud for WooCommerce Subscription Products plugin to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in Autoship Cloud for WooCommerce Subscription Products
See all- CVE-2026-24527Medium
Missing authorization in the Autoship Cloud for WooCommerce Subscription Products plugin allows exploiting incorrectly configured access control security levels. This vulnerability affects versions from n/a through 2.14.0.
- CVE-2024-13461Medium
The Autoship Cloud for WooCommerce Subscription Products plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'autoship-create-scheduled-order-action' shortcode in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Original NVD description (English source)
Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.17.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS