Subscriptions For Woocommerce
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:subscriptions_for_woocommerce:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Subscriptions For Woocommerce (e0c617fd-6689-57df-845d-a09bcba0185f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-87860 |
vulnerable | 2026-10-13 12:28:48.189696 |
Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making.
Published: 2026-09-16T06:00:16.817Z
Updated: 2026-09-17T12:32:58.406Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-87854 |
vulnerable | 2026-10-13 12:28:48.110748 |
Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and payment dates.
Published: 2026-09-16T06:00:16.629Z
Updated: 2026-09-17T12:33:12.863Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15214 |
vulnerable | 2026-09-16 04:33:06.798017 |
Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOR
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information (the subscribed product, status, and dates) by supplying that subscription's ID.
Published: 2026-08-07T06:00:11.615Z
Updated: 2026-08-07T18:00:32.984Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15211 |
vulnerable | 2026-09-16 04:33:06.748610 |
Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token
MEDIUM (5.9)
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is COMPLETED, without comparing the captured amount to the order total. This allows an attacker (unauthenticated where guest checkout is enabled) to substitute an approved, uncaptured PayPal order token and have an expensive order marked paid without paying its price.
Published: 2026-08-07T07:25:35.141Z
Updated: 2026-08-07T15:21:04.503Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15215 |
vulnerable | 2026-09-16 04:33:06.690398 |
Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) to install and activate arbitrary Subscriptions for WooCommerce WordPress plugin before 2.0.1, resulting in remote code execution.
Published: 2026-08-07T06:00:11.800Z
Updated: 2026-08-07T18:12:36.214Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.