CVE-2026-15214CWE-639

CVE-2026-15214

Medium · published August 7, 2026

CVSS v3.1

4.3

EPSS

Percentile

18.2

In the wild

Unconfirmed

What it is

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information (the subscribed product, status, and dates) by supplying that subscription's ID.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00270 · 18.2th percentile
Weakness: CWE-639 · Authorization Bypass Through User-Controlled Key
Published: 2026-08-07T10:16Z

References (1)

https://wpscan.com/vulnerability/d11cfec5-e1e6-4a01-84e2-4d42be1a72ac/ · [email protected]

EPSS history

Timeline

07 AUG 06:00Z
Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOR
cvelistv5