WordPress Plugin Vulnerabilities

Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF

Description

The plugin does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making.

Proof of Concept

Affects Plugins

Plugin icon
subscriptions-for-woocommerce
Fixed in 2.0.3

References

CVE
CVE-2026-87860

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Karthik Ramakrishnan
Submitter
Karthik Ramakrishnan
Verified
Yes
WPVDB ID
de479136-1b41-4bb1-b660-9fd662eb666e

Timeline

Publicly Published
2026-09-14 (about 2 days ago)
Added
2026-09-14 (about 1 day ago)
Last Updated
2026-09-14 (about 1 day ago)

Other

Published
Title
Published
2025-04-03
Title
Small Package Quotes – Worldwide Express Edition < 5.2.20 - Missing Authorization
Published
2025-04-02
Title
WP Video Playlist <= 1.1.2 - Missing Authorization to Unauthenticated Settings Update
Published
2022-03-30
Title
Advanced Custom Fields < 5.12.1 - Contributor+ Database Information Access
Published
2026-05-27
Title
3D Viewer < 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via settings REST endpoint
Published
2023-09-05
Title
Super Socializer < 7.13.55 - Missing Authorization