CVE-2026-24372
Received Received - Intake
Authentication Bypass in WP Swings WooCommerce Subscriptions

Publication date: 2026-03-25

Last updated on: 2026-04-29

Assigner: Patchstack

Description
Authentication Bypass by Spoofing vulnerability in WP Swings Subscriptions for WooCommerce subscriptions-for-woocommerce allows Input Data Manipulation.This issue affects Subscriptions for WooCommerce: from n/a through <= 1.8.10.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-25
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2026-03-25
EPSS Evaluated
2026-06-15
NVD
CVE-2026-24372
EUVD
EUVD-2026-15568
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wp_swings subscriptions_for_woocommerce to 1.8.10 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-24372 is an authentication bypass vulnerability in the WordPress plugin Subscriptions for WooCommerce, affecting versions up to and including 1.8.10.

This vulnerability allows an unauthenticated attacker to bypass certain code restrictions by manipulating input data, potentially enabling unauthorized actions without needing any additional privileges.

It is classified under OWASP Top 10 A4: Insecure Design and has a CVSS severity score of 7.5, indicating a moderate risk level.

Impact Analysis

This vulnerability can allow an attacker to perform unauthorized actions within the Subscriptions for WooCommerce plugin by bypassing authentication mechanisms.

Since no additional privileges are required to exploit this issue, it increases the risk of unauthorized access or manipulation of subscription-related data or functionality.

However, the vulnerability is considered low priority by Patchstack due to its low severity impact and the unlikelihood of exploitation.

Users are strongly advised to update to version 1.9.0 or later to mitigate this risk.

Detection Guidance

There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.

Mitigation Strategies

To mitigate this vulnerability, you should update the WordPress Subscriptions for WooCommerce plugin to version 1.9.0 or later, where the issue is patched.

Additionally, Patchstack offers mitigation services including auto-updates for vulnerable plugins, which can help reduce risk.

Compliance Impact

The provided information does not specify any direct impact of the CVE-2026-24372 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24372. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart