CVE-2026-15214

Name of the Vulnerable Software and Affected Versions Subscriptions for WooCommerce versions prior to 2.0.1

Description An Insecure Direct Object Reference (IDOR) exists where the plugin fails to verify if the requester owns the subscription before displaying its details. This allows any authenticated customer to access another customer's subscription information, including the subscribed product, status, and dates, by providing the specific subscription ID.

Recommendations Update Subscriptions for WooCommerce to version 2.0.1 or later.