CVE-2026-15214

Deferred Deferred - Pending Action

Subscriptions for WooCommerce Information Disclosure

Publication date: 2026-08-07

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information (the subscribed product, status, and dates) by supplying that subscription's ID.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-07

EPSS Evaluated

2026-08-26

NVD

CVE-2026-15214

EUVD

EUVD-2026-54379

Affected Vendors & Products

Vendor	Product	Version / Range
woocommerce	subscriptions_for_woocommerce	to 2.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This is an Insecure Direct Object Reference (IDOR) flaw in the Subscriptions for WooCommerce plugin before version 2.0.1. It allows authenticated users to view other customers' subscription details by changing subscription IDs in requests. Exposed data includes subscribed products, status, and dates.

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the 'Subscriptions for WooCommerce' plugin version prior to 2.0.1. Log in as a subscriber-level user and attempt to access subscription details by modifying the subscription ID in the URL or API requests. If other users' subscription data is exposed, the vulnerability is present.

Impact Analysis

An attacker with subscriber-level access could access another user's subscription information. This may lead to privacy breaches, data leaks, or misuse of subscription details. Businesses could face reputational damage or loss of customer trust.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without consent. For HIPAA, if health-related subscriptions are involved, it may breach protected health information rules. Non-compliance risks fines and legal penalties.

Mitigation Strategies

Immediately update the 'Subscriptions for WooCommerce' plugin to version 2.0.1 or later. If an update is not available, consider disabling the plugin until a patch is released. Review user roles and permissions to ensure subscribers cannot access unauthorized data.

Hi! I’m here to help you understand CVE-2026-15214. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70