wpswings Subscriptions for WooCommerce Plugin up to 1.9.2 on WordPress GET wps_sfw_admin_cancel_susbcription nonce authorization

Summaryinfo

A vulnerability marked as problematic has been reported in wpswings Subscriptions for WooCommerce Plugin up to 1.9.2 on WordPress. The affected element is the function wps_sfw_admin_cancel_susbcription of the component GET Handler. The manipulation of the argument nonce leads to authorization. This vulnerability is uniquely identified as CVE-2026-1926. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in wpswings Subscriptions for WooCommerce Plugin up to 1.9.2 on WordPress. It has been rated as problematic. This issue affects the function wps_sfw_admin_cancel_susbcription of the component GET Handler. The manipulation of the argument nonce with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is integrity. The summary by CVE is:

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `wps_sfw_admin_cancel_susbcription()` function in all versions up to, and including, 1.9.2. This is due to the function being hooked to the `init` action without any authentication or authorization checks, and only performing a non-empty check on the nonce parameter without actually validating it via `wp_verify_nonce()`. This makes it possible for unauthenticated attackers to cancel any active WooCommerce subscription by sending a crafted GET request with an arbitrary nonce value via the `wps_subscription_id` parameter.

The weakness was disclosed by Shrikant Bhosale. It is possible to read the advisory at wordfence.com. The identification of this vulnerability is CVE-2026-1926 since 02/04/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.9.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-12764). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• E-Commerce Management Software

Vendor

• wpswings

Name

• Subscriptions for WooCommerce Plugin

Version

• 1.9.0
• 1.9.1
• 1.9.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion