# CVE-2026-56061: WP Swings Subscriptions for WooCommerce broken access control

Source: https://junglewise.ai/threats/cve-2026-56061-wp-swings-subscriptions-for-woocommerce-broken-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-56061 · Severity: high · CVSS 7.5 · Published 2026-06-26

Subscriptions for WooCommerce is a WordPress plugin used to manage recurring payments and subscription-based products on e-commerce sites. A security flaw in versions 1.9.5 and earlier allows unauthorized individuals to perform actions that should be restricted to administrators or specific users. This could lead to unauthorized changes to subscription data or store settings, potentially disrupting business operations and revenue.

Technologies: [WP Swings Subscriptions for WooCommerce](https://junglewise.ai/threats/technologies/subscriptions-for-woocommerce). Vendors: [WP Swings](https://junglewise.ai/threats/vendors/wp-swings).

## Quick answers

**Is CVE-2026-56061 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56061 being exploited in the wild.

**How severe is CVE-2026-56061?** High severity, with a CVSS score of 7.5, published 26 June 2026.

**Which products and versions are affected?** WP Swings Subscriptions for WooCommerce <= 1.9.5.

**Is there a fix for CVE-2026-56061?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-56061 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56061?** Check whether you run WP Swings Subscriptions for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to broken access control due to missing authorization checks (CWE-862) in versions up to and including 1.9.5. This allows an unauthenticated remote attacker to execute functions or modify settings that should be restricted. The vulnerability has a CVSS score of 7.5, reflecting high integrity impact despite no direct confidentiality or availability impact reported. The issue is resolved in version 1.9.6.

## Affected products

- WP Swings Subscriptions for WooCommerce <= 1.9.5

## Timeline

- 2026-05-06: other: Reported by Jakub Herman
- 2026-06-25: advisory: Patchstack advisory published
- 2026-06-26: disclosed: NVD publication date

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/subscriptions-for-woocommerce/vulnerability/wordpress-subscriptions-for-woocommerce-plugin-1-9-5-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/subscriptions-for-woocommerce/vulnerability/wordpress-subscriptions-for-woocommerce-plugin-1-9-5-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [WP Swings Subscriptions for WooCommerce privilege escalation](https://junglewise.ai/threats/cve-2026-15414-wp-swings-subscriptions-for-woocommerce-privilege-escalation)
- [WP Swings Subscriptions for WooCommerce missing authorization in AJAX handler](https://junglewise.ai/threats/cve-2026-15397-wp-swings-subscriptions-for-woocommerce-missing-authorization-in)