CVE-2026-15414
Received Received - Intake

Privilege Escalation in Subscriptions for WooCommerce Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: Wordfence

Description
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the `save_meta_boxes()` function persisting the `_wps_plan_user_role` membership plan meta from `$_POST` without an allowlist that excludes privileged roles — the only validations applied, `sanitize_key()` and `wp_roles()->is_role()`, both accept `'administrator'` as a valid value, and the UI's `disabled` attribute on the role dropdown is a client-side-only control trivially bypassed via DevTools or a direct POST request; additionally, because the `wps_membership_plan` custom post type is registered with `capability_type => 'post'`, any user who can edit posts satisfies the `current_user_can('edit_post', $post_id)` guard in `save_meta_boxes()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their privileges to Administrator by storing `'administrator'` as the role granted on membership acquisition, which the Pro companion plugin then applies via `add_role()` during membership lifecycle events. Successful exploitation requires the Subscriptions for WooCommerce Pro companion plugin to be active, as it is the component that reads the stored `_wps_plan_user_role` meta via `get_post_meta()` and calls `add_role()` to apply the role during membership lifecycle events.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-15414
EUVD
EUVD-2026-51687

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
woocommerce subscriptions to 2.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows authenticated users with Contributor-level access or higher to escalate their privileges to Administrator in WordPress. The flaw exists in the Subscriptions for WooCommerce plugin versions up to 2.0.0. Attackers can exploit a client-side role dropdown bypass to send a POST request setting their user role to 'administrator'. The Pro companion plugin then applies this role during membership events.

Detection Guidance

Check for unauthorized privilege escalation attempts by reviewing WordPress user role changes. Inspect POST requests to the Subscriptions for WooCommerce plugin endpoints for attempts to set the _wps_plan_user_role parameter to 'administrator'. Monitor for new administrator accounts created unexpectedly.

Impact Analysis

If exploited, attackers can gain full administrative control over a WordPress site. This allows them to install malicious plugins, modify site content, steal sensitive data, or take over the entire site. The attack requires only Contributor-level access and the Pro companion plugin to be active.

Mitigation Strategies

Update the Subscriptions for WooCommerce plugin to the latest version beyond 2.0.0. Disable the Subscriptions for WooCommerce Pro companion plugin if not required. Review all user accounts for unauthorized administrator role assignments and remove any suspicious accounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15414. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart