CVE-2026-87856: vulnerability in Subscriptions for WooCommerce
Subscriptions for WooCommerce 2.0.0 - 2.1.0 - Unauthenticated Membership Content Restriction Bypass
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
0Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Track
The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on standard front-end page views, allowing unauthenticated users to read the full contents of restricted posts and pages through other routes that render the same content.
Affected products
Unknown · Subscriptions for WooCommerceRelated CVEs — Subscriptions for WooCommerce
In the same product, most dangerous first.
CVE-2026-15215HIGHSubscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin InstallationEPSS 0.6%CVE-2026-87854MEDIUMSubscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key BypassEPSS 0.3%CVE-2026-15214MEDIUMSubscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOREPSS 0.3%CVE-2026-87860MEDIUMSubscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRFEPSS 0.2%CVE-2026-15211MEDIUMSubscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture TokenEPSS 0.2%