Skip to content
Sign in
7.2 High

CVE-2026-15397 The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and…

Description

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via the wps_sfw_install_plugin_configuration AJAX handler. This makes it possible for authenticated attackers, with shop manager-level access and above, to install and activate arbitrary WordPress.org plugins.

Affected products and versions

Product Affected versions Fixed in
Subscriptions for WooCommerce 2.0 earliest → 2.0.0 No fix stated

Other CVEs of Subscriptions for WooCommerce

The 3 CVEs of Subscriptions for WooCommerce →
CVE-2026-15414 The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and… 8.8 High CVE-2026-1926 The Subscriptions for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a… 5.3 Medium
Track this CVE