CVE-2026-15397 in Subscriptions for WooCommerce Plugin
Summary
by MITRE • 07/30/2026
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via the wps_sfw_install_plugin_configuration AJAX handler. This makes it possible for authenticated attackers, with shop manager-level access and above, to install and activate arbitrary WordPress.org plugins.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
The vulnerability in the Subscriptions for WooCommerce plugin affects versions up to and including 2.0.0, representing a critical authorization flaw that undermines the security posture of WordPress installations. This issue stems from inadequate validation within the wps_sfw_install_plugin_configuration AJAX handler, which fails to properly verify user credentials and permissions before executing sensitive operations. The flaw specifically targets authenticated users who possess shop manager-level access or higher, creating a pathway for privilege escalation and unauthorized plugin installation.
The technical implementation of this vulnerability resides in the plugin's insufficient input validation mechanisms during AJAX processing. When an authenticated user accesses the wps_sfw_install_plugin_configuration endpoint, the system does not perform adequate capability checks to ensure that the requesting user possesses the necessary administrative privileges to install plugins. This missing authorization check creates a direct attack vector where malicious actors with shop manager permissions can leverage the legitimate plugin functionality to install arbitrary WordPress.org plugins without proper authorization.
From an operational perspective, this vulnerability presents significant risks to WordPress site security and integrity. Attackers with shop manager-level access can exploit this flaw to install malicious plugins that may contain backdoors, data exfiltration capabilities, or other harmful components. The installation of arbitrary plugins undermines the principle of least privilege and can lead to complete system compromise, especially when combined with other vulnerabilities or attack vectors. The impact extends beyond immediate plugin installation as it enables attackers to establish persistent access, modify site functionality, or redirect traffic to malicious destinations.
The vulnerability aligns with CWE-863 (Insufficient Authorization) and represents a clear violation of security best practices for WordPress plugin development. It also maps to ATT&CK technique T1059.001 (Command and Scripting Interpreter: PowerShell) and T1105 (Ingress Tool Transfer) when attackers use the compromised system to download and install additional malicious software. Organizations using affected versions should immediately implement mitigations including plugin updates, role restriction measures, and enhanced monitoring of plugin installation activities. The recommended remediation involves applying the latest plugin version that addresses this authorization gap and implementing proper access controls to limit administrative capabilities to only essential personnel with verified identities.