Executive brief
The Subscriptions for WooCommerce plugin for WordPress, which manages recurring payments for online stores, contains a security flaw that allows unauthorized plugin installations. An attacker with Shop Manager level access or higher can exploit this to install and activate any plugin from the WordPress.org repository. This could lead to a full site takeover or the introduction of malicious software that compromises customer data and store operations.
Technical details
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to a Missing Authorization flaw (CWE-862) within the wps_sfw_install_plugin_configuration AJAX handler. The root cause is a failure to properly verify user permissions before executing plugin installation and activation actions. An authenticated attacker with Shop Manager-level privileges or higher can leverage this vulnerability to install and activate any arbitrary plugin from the WordPress.org repository. This could be used as a vector for further site compromise or remote code execution depending on the installed plugin's capabilities. The vulnerability is present in all versions up to and including 2.0.0.
Affected products
- WP Swings Subscriptions for WooCommerce up to, and including, 2.0.0
Timeline
- 2026-07-30: disclosed
- 2026-07-30: advisory
References
- http://plugins.trac.wordpress.org/changeset?reponame=&old=3624543%40subscriptions-for-woocommerce&new=3624543%40subscriptions-for-woocommerce
- https://plugins.trac.wordpress.org/browser/subscriptions-for-woocommerce/tags/2.0.0/admin/class-subscriptions-for-woocommerce-admin.php
- https://plugins.trac.wordpress.org/browser/subscriptions-for-woocommerce/tags/2.0.0/admin/class-subscriptions-for-woocommerce-admin.php
- https://plugins.trac.wordpress.org/browser/subscriptions-for-woocommerce/tags/2.0.0/includes/class-subscriptions-for-woocommerce.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7e898e40-2cc3-4b5a-833b-899e9c9f26d3?source=cve