The vulnerability allows an actor to forge authentication credentials, enabling them to view and modify subscription data that should be restricted to administrators. This type of flaw, classified as a credential‑spoofing bypass, can expose sensitive customer information and potentially allow the creation, cancellation, or alteration of subscriptions without proper authority, thereby undermining the integrity and confidentiality of subscription data.

WordPress sites that have installed the WP Swings Subscriptions for WooCommerce plugin at version 1.8.10 or earlier are vulnerable. The issue applies to all releases from the earliest available build up to and including the 1.8.10 release. Any site running a version in this range will have the authentication bypass until updated.

The flaw carries a CVSS score of 7.5, indicating a high level of risk. Its EPSS score is reported to be below 1 %, denoting a low probability of exploitation in the wild, and it is not listed in CISA’s Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector involves submitting specially crafted HTTP requests to the plugin’s endpoints that masquerade as legitimate administrative actions. An attacker with network-level access to the WordPress environment, even with minimal credentials, can exploit this weakness to manipulate subscription data.