CVE-2026-15214
Received Received - Intake

Subscriptions for WooCommerce Information Disclosure

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: WPScan

Description
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information (the subscribed product, status, and dates) by supplying that subscription's ID.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-15214
EUVD
EUVD-2026-54379

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
woocommerce subscriptions_for_woocommerce to 2.0.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Insecure Direct Object Reference (IDOR) flaw in the Subscriptions for WooCommerce plugin before version 2.0.1. It allows authenticated users to view other customers' subscription details by changing subscription IDs in requests. Exposed data includes subscribed products, status, and dates.

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the 'Subscriptions for WooCommerce' plugin version prior to 2.0.1. Log in as a subscriber-level user and attempt to access subscription details by modifying the subscription ID in the URL or API requests. If other users' subscription data is exposed, the vulnerability is present.

Impact Analysis

An attacker with subscriber-level access could access another user's subscription information. This may lead to privacy breaches, data leaks, or misuse of subscription details. Businesses could face reputational damage or loss of customer trust.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without consent. For HIPAA, if health-related subscriptions are involved, it may breach protected health information rules. Non-compliance risks fines and legal penalties.

Mitigation Strategies

Immediately update the 'Subscriptions for WooCommerce' plugin to version 2.0.1 or later. If an update is not available, consider disabling the plugin until a patch is released. Review user roles and permissions to ensure subscribers cannot access unauthorized data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15214. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart