Subscriptions For Woocommerce CVEs and Security Vulnerabilities

CVE-2026-87854

Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and payment dates.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Subscriptions For Woocommerce

CVE-2026-87860

Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed