CVE-2026-15397

HIGH 7.2

Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action

CVSS Score

7.2

EPSS Score

0.0%

EPSS Percentile

0th

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via the wps_sfw_install_plugin_configuration AJAX handler. This makes it possible for authenticated attackers, with shop manager-level access and above, to install and activate arbitrary WordPress.org plugins.

CWE	CWE-862
Vendor	wpswings
Product	subscriptions for woocommerce
Published	Jul 30, 2026
Last Updated	Jul 30, 2026

Stay Ahead of the Next One

Get instant alerts for wpswings subscriptions for woocommerce

Be the first to know when new high vulnerabilities affecting wpswings subscriptions for woocommerce are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

wpswings / Subscriptions for WooCommerce

0 ≤ 2.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

Credits

Wordfence PRISM