31 matches found
CVE-2026-87854
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...
CVE-2026-87860
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...
CVE-2026-87854 Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...
CVE-2026-87860 Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...
CVE-2026-87854 Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...
WordPress Subscriptions for WooCommerce plugin < 2.0.3 - Subscription Cancellation vulnerability
Subscription Cancellation vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Subscriptions for WooCommerce versions 2.0.3...
EUVD-2026-80209
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...
WordPress Subscriptions for WooCommerce plugin < 2.0.3 - Unauthenticated Subscription Data Disclosure vulnerability
Unauthenticated Subscription Data Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Subscriptions for WooCommerce versions 2.0.3...
EUVD-2026-80208
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...
CVE-2026-87860 Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...
CVE-2026-87860: Missing Authorization
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...
CVE-2026-87854: Exposure of Sensitive Information to an Unauthorized Actor
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...
PT-2026-93310
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...
WordPress Subscriptions for WooCommerce plugin < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation vulnerability
Shop Manager+ Arbitrary Plugin Installation vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Subscriptions for WooCommerce versions 2.0.1...
CVE-2026-17016: Improper Access Control
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully...
CVE-2026-17012: Improper Access Control
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order...
CVE-2026-15214
The Subscriptions for WooCommerce WordPress plugin, in versions before 2.0.1 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify if a requester owns a specific subscription before rendering its details. This allows any authenticated customer to access an...
CVE-2026-15215: Improper Privilege Management
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manage...
CVE-2026-15214: Authorization Bypass Through User-Controlled Key
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information the subscribed product, status, and dates by...
CVE-2026-15211: Insufficient Verification of Data Authenticity
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is...