Is CVE-2026-56061 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56061 being exploited in the wild.

How severe is CVE-2026-56061?

High severity, with a CVSS score of 7.5, published 26 June 2026.

Which products and versions are affected?

WP Swings Subscriptions for WooCommerce <= 1.9.5.

Is there a fix for CVE-2026-56061?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-56061 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56061?

Check whether you run WP Swings Subscriptions for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56061: WP Swings Subscriptions for WooCommerce broken access control

Q: Is there a fix for CVE-2026-56061?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-56061 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-56061?

Check whether you run WP Swings Subscriptions for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56061 · Severity: high · CVSS 7.5 · Published 2026-06-26

Subscriptions for WooCommerce is a WordPress plugin used to manage recurring payments and subscription-based products on e-commerce sites. A security flaw in versions 1.9.5 and earlier allows unauthorized individuals to perform actions that should be restricted to administrators or specific users. This could lead to unauthorized changes to subscription data or store settings, potentially disrupting business operations and revenue.

Technologies: WP Swings Subscriptions for WooCommerce. Vendors: WP Swings.

Quick answers

Is CVE-2026-56061 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56061 being exploited in the wild.
How severe is CVE-2026-56061?: High severity, with a CVSS score of 7.5, published 26 June 2026.
Which products and versions are affected?: WP Swings Subscriptions for WooCommerce <= 1.9.5.
Is there a fix for CVE-2026-56061?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-56061 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56061?: Check whether you run WP Swings Subscriptions for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to broken access control due to missing authorization checks (CWE-862) in versions up to and including 1.9.5. This allows an unauthenticated remote attacker to execute functions or modify settings that should be restricted. The vulnerability has a CVSS score of 7.5, reflecting high integrity impact despite no direct confidentiality or availability impact reported. The issue is resolved in version 1.9.6.

Affected products

WP Swings Subscriptions for WooCommerce <= 1.9.5

Timeline

2026-05-06: other: Reported by Jakub Herman
2026-06-25: advisory: Patchstack advisory published
2026-06-26: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.