A flaw in the Subscriptions for WooCommerce plugin up to version 1.9.5 allows an unauthenticated attacker to bypass normal access checks. The weakness is an Access Control Failure (CWE‑862) that can let attackers create, modify, or cancel subscriptions without a valid user session, potentially leaking personal data or disrupting revenue streams.

The affected product is WP Swings Subscriptions for WooCommerce. Versions 1.9.5 and earlier are impacted. No other vendors or products are listed.

The CVSS score of 7.5 indicates high severity. The EPSS score is not available, but the lack of a KEV listing suggests no confirmed exploitation yet. Based on the description, it is inferred that attackers can likely exploit the issue by sending specially crafted HTTP requests to the plugin’s endpoints without authenticating, making it readily actionable once the vulnerability is known.