WordPress Plugin Vulnerabilities

Subscriptions for WooCommerce 2.0.0 - 2.1.0 - Unauthenticated Membership Content Restriction Bypass

Description

The plugin only enforces its membership content restrictions on standard front-end page views, allowing unauthenticated users to read the full contents of restricted posts and pages through other routes that render the same content.

Proof of Concept

Affects Plugins

Plugin icon
subscriptions-for-woocommerce
Fixed in 2.1.1

References

CVE
CVE-2026-87856

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Karthik Ramakrishnan
Submitter
Karthik Ramakrishnan
Verified
Yes
WPVDB ID
cbb00245-1e9b-4311-a4d0-ae80488e82d0

Timeline

Publicly Published
2026-11-02 (about 3 days ago)
Added
2026-11-02 (about 2 days ago)
Last Updated
2026-11-02 (about 2 days ago)

Other

Published
Title
Published
2026-07-17
Title
Direct Payments for WooCommerce < 2.5.3 - Unauthenticated Cross-Customer Order Tampering via digages AJAX Actions
Published
2026-06-22
Title
Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Auto-Approved Comment Creation
Published
2026-02-18
Title
Advanced Ads – Ad Manager & AdSense < 2.0.15 - Missing Authorization to Authenticated (Subscriber+) Ad Placements Update
Published
2024-01-24
Title
Views for WPForms < 3.2.3 - Cross-Site Request Forgery via create_view
Published
2024-10-31
Title
Multiple Page Generator Plugin – MPG < 4.0.2 - Missing Authorization