CVE-2026-87856: fallo en Subscriptions for WooCommerce
Subscriptions for WooCommerce 2.0.0 - 2.1.0 - Unauthenticated Membership Content Restriction Bypass
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
0Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Track
The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on standard front-end page views, allowing unauthenticated users to read the full contents of restricted posts and pages through other routes that render the same content.
Productos afectados
Unknown · Subscriptions for WooCommerceCVEs relacionadas — Subscriptions for WooCommerce
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-15215HIGHSubscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin InstallationEPSS 0.6%CVE-2026-87854MEDIUMSubscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key BypassEPSS 0.3%CVE-2026-15214MEDIUMSubscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOREPSS 0.3%CVE-2026-87860MEDIUMSubscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRFEPSS 0.2%CVE-2026-15211MEDIUMSubscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture TokenEPSS 0.2%