CVE-2026-87860: fallo de gravedad media en Subscriptions for WooCommerce
Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 4.3epss 0.2%
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Productos afectados
Unknown · Subscriptions for WooCommercePoCs públicas encontradas — 1
cve_referencewpscan.com/vulnerability/de479136-1b41-4bb1-b660-9fd662eb666e/no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Subscriptions for WooCommerce
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-15215HIGHSubscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin InstallationEPSS 0.6%CVE-2026-87854MEDIUMSubscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key BypassEPSS 0.3%CVE-2026-15214MEDIUMSubscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOREPSS 0.3%CVE-2026-87856MEDIUMSubscriptions for WooCommerce 2.0.0 - 2.1.0 - Unauthenticated Membership Content Restriction BypassEPSS 0.2%CVE-2026-15211MEDIUMSubscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture TokenEPSS 0.2%