CVE-2026-56061

The Subscriptions for WooCommerce plugin for WordPress (all versions up to and including 2.0.0) fails to properly verify user authorization in the wps_sfw_install_plugin_configuration AJAX handler, allowing authenticated attackers with shop manager-level access or higher to install and activate arbitrary WordPress.org plugins.

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription. Attackers can trick a logged-in customer into making a crafted request that cancels their own active subscription.

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints. Unauthenticated users can retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and payment dates.

The Subscriptions for WooCommerce WordPress plugin before version 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow. It captures a client-supplied token and marks the order paid whenever the capture status is COMPLETED, without comparing the captured amount to the order total. This allows an attacker (unauthenticated where guest checkout is enabled) to substitute an approved, uncaptured PayPal order token and have an expensive order marked paid without paying its price.

The Subscriptions for WooCommerce plugin for WordPress up to version 2.0.0 has a privilege escalation vulnerability. The save_meta_boxes() function saves the user role from POST without proper validation, and the 'wps_membership_plan' post type has capability_type 'post', allowing users with Contributor-level access and above to set the role to 'administrator'. Exploitation requires the Pro plugin to be active.