Subscriptions for WooCommerce

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Subscriptions for WooCommerce

Information

Software Type Plugin
Software Slug subscriptions-for-woocommerce (view on wordpress.org)
Software Status Active
Software Author wpswings
Software Website wordpress.org
Software Downloads 509,703
Software Active Installs 10,000
Software Record Last Updated August 11, 2026

5 Vulnerabilities

Submit a Vulnerability
Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta
8.8
CVE-2026-15414
Jul 31, 2026
Researcher: Wordfence PRISM
Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action
7.2
CVE-2026-15397
Jul 29, 2026
Researcher: Wordfence PRISM
Subscriptions for WooCommerce <= 1.9.5 - Missing Authorization
5.3
CVE-2026-56061
Jun 25, 2026
Researcher: Jakub Herman
Subscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation
5.3
CVE-2026-1926
Mar 17, 2026
Researcher: shrikant bhosale
Subscriptions for WooCommerce <= 1.8.10 - Missing Authorization
5.3
CVE-2026-24372
Mar 13, 2026
Researcher: PPzzAArr
Title Status CVE ID CVSS Researchers Date
Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta Patched CVE-2026-15414 8.8 Wordfence PRISM July 31, 2026
Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action Patched CVE-2026-15397 7.2 Wordfence PRISM July 29, 2026
Subscriptions for WooCommerce <= 1.9.5 - Missing Authorization Patched CVE-2026-56061 5.3 Jakub Herman June 25, 2026
Subscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation Patched CVE-2026-1926 5.3 shrikant bhosale March 17, 2026
Subscriptions for WooCommerce <= 1.8.10 - Missing Authorization Patched CVE-2026-24372 5.3 PPzzAArr March 13, 2026

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation