The WPSubscription plugin contains an insecure direct object reference flaw that permits a user to supply a manipulated key in web requests, bypassing the intended access controls. By crafting such requests, an attacker can view or alter subscription data that belongs to other users, leading to the disclosure or modification of confidential subscription information. This vulnerability is a classic example of authorization bypass through a user-controlled key, identified as CWE-639.

All WordPress sites running the Convers Lab WPSubscription plugin version 1.8.10 or earlier are vulnerable, as the flaw exists in all releases from the earliest available version up to and including 1.8.10.

The CVSS score of 8.5 places this issue in the high severity range, while the EPSS score of less than 1% indicates a low overall exploitation likelihood. The plugin is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via crafted HTTP requests that manipulate the plugin’s key parameter, requiring valid user credentials or a legitimate user role to submit the request. An attacker who succeeds would gain read or write access to data that should be protected by proper authorization checks.