CVE-2026-15215— Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation
Quick assessment
Affected
Unknown Subscriptions for WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WooCommerce订阅插件（Subscriptions for WooCommerce）在2.0.1版本之前存在一个安全漏洞。该漏洞源于插件在安装和激活过程中，未对用户权限进行验证。攻击者可以通过一个由nonce保护的AJAX请求，利用用户提供的插件名称slug，安装并激活任意版本的WooCommerce订阅插件（2.0.1之前）。这导致具备Shop Manager角色的用户（尽管他们不具备管理WooCommerce订阅插件的功能）也能安装并激活任意插件，从而引发远程代码执行风险。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Subscriptions for WooCommerce | < 2.0.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-15215
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation
Source: CVE Program / CVE List V5
Vulnerability Description
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) to install and activate arbitrary Subscriptions for WooCommerce WordPress plugin before 2.0.1, resulting in remote code execution.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Subscriptions for WooCommerce | 0 ~ 2.0.1 | - |
|
II. Public POCs for CVE-2026-15215
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-15215
请登录查看更多情报信息。
Other References for CVE-2026-15215 (1)
-
🔗 Subscriptions for WooCommerce < 2.0.1 – Shop Manager+ Arbitrary Plugin Installation | CVE 2026-15215 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-08-07 · 21 CVEs total
| CVE-2026-15211 | 5.9 MEDIUM | Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Captur |
| CVE-2026-15148 | 5.3 MEDIUM | WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via I |
| CVE-2026-15239 | 5.3 MEDIUM | Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection B |
| CVE-2026-14205 | WP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter | |
| CVE-2026-14943 | Password Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST API | |
| CVE-2026-14331 | Subscribe2 < 10.46 - Reflected XSS via email Parameter | |
| CVE-2026-15032 | wpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion | |
| CVE-2026-15214 | Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDO | |
| CVE-2026-15359 | Templately < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection Overwrite | |
| CVE-2026-15245 | BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode | |
| CVE-2026-16030 | MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication | |
| CVE-2026-16039 | MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR | |
| CVE-2026-16038 | MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways | |
| CVE-2026-15361 | Content Views < 4.5 - Subscriber+ SQL Injection via preview_request | |
| CVE-2026-15386 | Meow Gallery < 5.5.2 - Author+ Stored XSS via Attachment Alt-Text | |
| CVE-2026-16262 | Estatik < 4.3.3 - Login CSRF | |
| CVE-2026-16041 | MStore API < 4.21.0 - Unauthenticated Product Review Creation | |
| CVE-2026-16263 | WP Maps < 4.9.7 - Subscriber+ Local File Inclusion | |
| CVE-2026-16265 | WP Maps < 4.9.7 - Subscriber+ Denial of Service | |
| CVE-2026-16258 | Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics RES |
IV. Related Vulnerabilities
Same product: Subscriptions for WooCommerce
-
CVE-2026-87860
Subscriptions for WooCommerce < 2.0.3 - Subscription Cancell -
CVE-2026-87854
Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subs -
CVE-2026-15211
Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via A -
CVE-2026-15214
Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscrip -
CVE-2026-15414
Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Cont
Same vendor: Unknown
-
CVE-2026-92924
Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbi -
CVE-2026-97219
MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via -
CVE-2026-91020
WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticat -
CVE-2026-90987
Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenti -
CVE-2026-90952
WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated S
V. Comments for CVE-2026-15215
No comments yet