PT-2026-68860 · WordPress · Woocommerce Subscriptions
CVE-2026-15214
·
Published
2026-08-07
·
Updated
2026-08-07
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Subscriptions for WooCommerce versions prior to 2.0.1
Description
An Insecure Direct Object Reference (IDOR) exists where the plugin fails to verify if the requester owns the subscription before displaying its details. This allows any authenticated customer to access another customer's subscription information, including the subscribed product, status, and dates, by providing the specific subscription ID.
Recommendations
Update Subscriptions for WooCommerce to version 2.0.1 or later.
Exploit
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Woocommerce Subscriptions