CVE-2026-15414

Name of the Vulnerable Software and Affected Versions Subscriptions for WooCommerce versions prior to 2.0.1

Description An issue exists where authenticated users with Contributor-level access or higher can escalate their privileges to Administrator. This occurs because the save meta boxes() function saves the wps plan user role membership plan meta from $ POST without an allowlist to exclude privileged roles. The validations used, sanitize key() and wp roles()->is role(), both permit the value 'administrator'. Furthermore, the wps membership plan custom post type is registered with capability type => 'post', allowing any user capable of editing posts to bypass the current user can('edit post', $post id) check. Exploitation is possible if the Subscriptions for WooCommerce Pro companion plugin is active, as it uses get post meta() to read the wps plan user role and applies the role via add role() during membership lifecycle events.

Recommendations Update Subscriptions for WooCommerce to a version newer than 2.0.0. As a temporary mitigation, restrict access to the save meta boxes() function or disable the Subscriptions for WooCommerce Pro companion plugin to prevent the application of the stored role.