Woocommerce Subscriptions < 3.0.3 - CSRF to Cancel/Re-Activate Subscription

Description

During a blog assessment, we identified a CSRF issue in the Woocommerce Subscriptions plugin, which could allow attackers to cancel and re-activate a logged in user's subscription. Even though the _wpnonce parameter was needed in the request, its value was not verified, allowing an empty value to be honoured.

Knowledge of the subscription_id parameter is required, or could be iterated upon hoping to guess the correct one for the logged in user.