The Subscriptions for WooCommerce plugin contains a missing capability check in the wps_sfw_admin_cancel_susbcription() function. The function is hooked to the WordPress init action without any authentication or authorization checks, and it only verifies that a nonce parameter is not empty, without calling wp_verify_nonce(). Because of this flaw, an unauthenticated attacker can cancel any active WooCommerce subscription by sending a crafted GET request that includes a non‑verified nonce value via the wps_subscription_id parameter. The vulnerability represents a missing authorization flaw (CWE-862) and results in the unauthorized modification of subscription status.

The vendor is wpswings and the affected product is Subscriptions for WooCommerce. All releases up to and including version 1.9.2 are vulnerable. No other versions are known to be impacted.

The CVSS score of 5.3 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires no credentials; the attacker only needs to construct a GET request to the plugin’s cancellation endpoint with an arbitrary, non‑verified nonce. The lack of authentication barriers makes the attack straightforward and increases the risk of unauthorized subscription cancellation.