CVE-2026-15214 in Subscriptions for WooCommerce Plugin
Summary
by MITRE • 08/07/2026
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information (the subscribed product, status, and dates) by supplying that subscription's ID.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability exists within the Subscriptions for WooCommerce WordPress plugin version 2.0.1 and earlier, where insufficient access control mechanisms fail to validate ownership of subscription resources before rendering sensitive subscription details. This represents a critical authorization flaw that directly violates fundamental security principles governing resource access and data protection. The technical implementation lacks proper validation checks that would normally ensure only the legitimate owner of a subscription can access its associated information, creating an unauthorized information disclosure scenario.
The flaw manifests when authenticated customers attempt to view subscription details by manipulating the subscription ID parameter in API requests or direct endpoint calls. The plugin fails to cross-reference the requesting user's credentials against the target subscription record, allowing any logged-in user to potentially retrieve another customer's subscription data including product details, current subscription status, and temporal information such as start dates, end dates, and renewal schedules. This vulnerability specifically affects the plugin's subscription viewing functionality and represents a classic case of insufficient access control validation.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially enable more sophisticated attacks including subscription hijacking, account takeovers, and data exfiltration. Attackers can systematically enumerate subscription IDs to gather intelligence about customer base, identify premium subscription holders, and map business relationships within the WooCommerce ecosystem. From a compliance perspective, this exposure violates privacy regulations such as gdpr and pci dss requirements for protecting customer data. The vulnerability also creates potential revenue loss opportunities through subscription fraud and competitor intelligence gathering.
This vulnerability aligns with CWE-285 (Improper Authorization) and maps to ATT&CK technique T1071.004 (Application Layer Protocol: DNS) when attackers use enumeration techniques to discover valid subscription IDs, and T1566 (Phishing) if compromised data is used for social engineering attacks. The weakness stems from inadequate input validation and missing user context verification mechanisms within the plugin's access control framework. Organizations using this plugin face significant risk of customer data exposure and potential regulatory penalties. Recommended mitigations include immediate plugin updates to version 2.0.1 or later, implementation of proper subscription ownership verification checks, and deployment of web application firewalls to monitor for suspicious enumeration patterns. Additionally, administrators should conduct thorough access control reviews and implement principle of least privilege configurations to minimize potential damage from similar authorization flaws in other plugins or custom code implementations.