Veille CVE

Recherche « Unknown Subscriptions for WooCommerce »

8 CVE

Critique 1 Élevée 1 Moyenne 5 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Subscriptions for WooCommerce » ✕
  1. CVE-2026-87860 4.3 Moyenne

    Unknown Subscriptions for WooCommerce

    The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making.

  2. CVE-2026-87854 5.3 Moyenne

    Unknown Subscriptions for WooCommerce

    The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and payment dates.

  3. CVE-2026-18391 9.8 Critique

    Unknown WooCommerce Subscriptions

    The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.

  4. CVE-2026-17016 3.7 Faible

    Unknown Accept PayPal & Stripe with Subscriptions for WooCommerce

    The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully paid when the PayPal Data Transfer feature is enabled.

  5. CVE-2026-17012 5.3 Moyenne

    Unknown Accept PayPal & Stripe with Subscriptions for WooCommerce

    The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order by paying the full amount to their own PayPal account instead of the merchant's.

  6. CVE-2026-15211 5.9 Moyenne

    Unknown Subscriptions for WooCommerce

    The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is COMPLETED, without comparing the captured amount to the order total. This allows an attacker (unauthenticated where guest checkout is enabled) to substitute an approved, uncaptured PayPal order token and have an expensive order marked paid without paying its price.

  7. CVE-2026-15215 8.8 Élevée

    Unknown Subscriptions for WooCommerce

    The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) to install and activate arbitrary Subscriptions for WooCommerce WordPress plugin before 2.0.1, resulting in remote code execution.

  8. CVE-2026-15214 4.3 Moyenne

    Unknown Subscriptions for WooCommerce

    The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information (the subscribed product, status, and dates) by supplying that subscription's ID.