35 matches found
CVE-2026-87854
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...
CVE-2026-87860
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...
EUVD-2026-80209
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...
EUVD-2026-80208
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...
CVE-2026-87854 Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...
CVE-2026-87854 Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...
CVE-2026-87860 Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...
CVE-2026-87860 Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...
WordPress Subscriptions for WooCommerce plugin < 2.0.3 - Subscription Cancellation vulnerability
Subscription Cancellation vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Subscriptions for WooCommerce versions 2.0.3...
WordPress Subscriptions for WooCommerce plugin < 2.0.3 - Unauthenticated Subscription Data Disclosure vulnerability
Unauthenticated Subscription Data Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Subscriptions for WooCommerce versions 2.0.3...
CVE-2026-87860: Missing Authorization
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...
PT-2026-93310
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...
CVE-2026-87854: Exposure of Sensitive Information to an Unauthorized Actor
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...
WordPress Subscriptions for WooCommerce plugin < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation vulnerability
Shop Manager+ Arbitrary Plugin Installation vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Subscriptions for WooCommerce versions 2.0.1...
CVE-2026-17012: Improper Access Control
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order...
PT-2026-69358
Name of the Vulnerable Software and Affected Versions Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin versions prior to 3.1.1 Description The plugin fails to validate the actual amount paid against the order total within its PayPal Data Transfer return handler. This fla...
CVE-2026-17016: Improper Access Control
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully...
CVE-2026-15214
The Subscriptions for WooCommerce WordPress plugin, in versions before 2.0.1 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify if a requester owns a specific subscription before rendering its details. This allows any authenticated customer to access an...
PT-2026-68876
Name of the Vulnerable Software and Affected Versions Subscriptions for WooCommerce versions prior to 2.0.1 Description An issue exists in the WooCommerce order-received flow where the plugin fails to validate the payment amount or bind the PayPal order token to the order being completed. The...
PT-2026-68861
Name of the Vulnerable Software and Affected Versions Subscriptions for WooCommerce versions prior to 2.0.1 Description An issue exists where the software fails to verify user capabilities before installing and activating a plugin from a user-supplied slug via a nonce-protected AJAX action. This...