Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Subscriptions for WooCommerce 2.0.1 Clear all filters
TI-2026-12808 CVE-2026-15211 · GHSA-p384-7c3j-gqm7

Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token

Priority MEDIUM 60

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a clien…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00156 Published 2026-08-07 Fixed in 2.0.1 CWE-345
TI-2026-12812 CVE-2026-15215 · GHSA-m77w-m8qm-q9pv

Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation

Priority HIGH 73

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied sl…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00636 Published 2026-08-07 Fixed in 2.0.1 CWE-269
TI-2026-12811 CVE-2026-15214 · GHSA-qhjm-7mgh-6mhm

Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOR

Priority MEDIUM 53

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another cust…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-08-07 Fixed in 2.0.1 CWE-639