Security Alert Summary
The Subscriptions for WooCommerce plugin (versions before 2.0.1) fails to verify that the requester owns a subscription before rendering its details. As a result, any authenticated customer can view another customer’s subscription information (subscribed product, status, and dates) by supplying that subscription’s ID.
CVE Details
- CVE ID:
CVE-2026-15214 - Affected component: Subscriptions for WooCommerce WordPress plugin
- Affected versions: Versions before 2.0.1
- Published: August 7, 2026 at 6:16:55 AM
- Last modified: August 7, 2026 at 6:16:55 AM
- CVSS v3.1: Not provided in this CVE record
- Authentication / privileges / user interaction: Authentication required – any authenticated customer account can retrieve another customer’s subscription details by supplying the subscription ID. No additional privileges are indicated; user interaction is limited to making the request while authenticated.
- Primary impact: Confidentiality – disclosure of subscription information (subscribed product, status, dates). Integrity – none indicated. Availability – none indicated.
- CWE / weakness: Not provided
Technical Details
The plugin does not verify ownership of the requested subscription before rendering its details. Specifically, when a subscription ID is supplied by an authenticated user, the plugin returns the subscription information (including the subscribed product, subscription status, and dates) without confirming that the requester is the subscription owner. The CVE description notes this behavior directly; no specific functions or REST endpoints are named in the record.
Impact is limited to disclosure of subscription-related data as described. The issue does not, based on the provided information, indicate modification of data or denial of service; it is an authorization check omission that leads to unauthorized read access to subscription details.
How This Could Impact Your Website
Consider a small ecommerce site where the site owner, several internal staff members (support or billing), and external contractors manage subscriptions. If any authenticated customer can view other customers’ subscription records by supplying an ID, then subscription details such as product names, subscription status, and billing dates could be exposed to other customers. That information can reveal purchasing behavior and timing and may include or be linked to email addresses or other account identifiers stored on the site.
Practical consequences include exposure of customer data that could be used to craft targeted phishing or social engineering messages aimed at customers or staff, and reduced trust from customers if they learn their subscription information was disclosed. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other accounts with persistent access.
- Enforce strong passwords and two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins to reduce your attack surface.
- Monitor site activity and logs for unusual behavior, such as repeated requests for subscription IDs from a single account.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
