Junglewise Threat Intelligence

CVE-2026-15414: WP Swings Subscriptions for WooCommerce privilege escalation

CVE-2026-15414 · Severity: high · CVSS 8.8 · Published 2026-08-01

Executive brief

The Subscriptions for WooCommerce plugin for WordPress, which manages recurring payments and memberships, contains a security flaw that allows low-level users to upgrade their own accounts to Administrator status. By manipulating membership settings, an attacker with basic contributor access can gain full control over the website. This could lead to total site takeover, data theft, and the ability to modify or delete any content on the platform.

Technical details

The vulnerability exists in the `save_meta_boxes()` function of the Subscriptions for WooCommerce plugin due to improper validation of the `_wps_plan_user_role` meta field. While the plugin uses `sanitize_key()` and `wp_roles()->is_role()`, it lacks an allowlist to prevent the assignment of privileged roles like 'administrator'. Furthermore, the `wps_membership_plan` custom post type uses the default 'post' capability type, allowing any user with 'edit_posts' permissions (Contributor and above) to bypass the `current_user_can` check. When the Pro companion plugin is active, it reads this stored meta and applies the 'administrator' role to the user via `add_role()` during membership lifecycle events. A fix is available in versions following 2.0.0.

Affected products

  • WP Swings (wpswings) Subscriptions for WooCommerce up to, and including, 2.0.0

Timeline

  • 2026-07-31: disclosed: Initial disclosure by Wordfence
  • 2026-08-01: advisory: NVD publication date

References

Related threats