CVE-2026-87854— Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass
Quick assessment
Affected
Unknown Subscriptions for WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WooCommerce Subscriptions（WooCommerce 订阅）WordPress 插件在 2.0.3 版本之前，未正确验证保护其某个 REST API 端点的共享密钥（shared secret），导致未经身份验证的用户能够获取商店的完整订阅列表，其中包含客户用户名、产品名称、周期性金额以及支付日期等敏感信息。
Possible ATT&CK Techniques 1 AI
T1589.001 · CredentialsAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Subscriptions for WooCommerce | < 2.0.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-87854
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and payment dates.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Subscriptions for WooCommerce | 0 ~ 2.0.3 | - |
|
II. Public POCs for CVE-2026-87854
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-87854
请登录查看更多情报信息。
Other References for CVE-2026-87854 (1)
-
🔗 Subscriptions for WooCommerce < 2.0.3 – Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass | CVE 2026-87854 | Plugin Vulnerabilities exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-16 · 46 CVEs total
| CVE-2026-13407 | 6.1 MEDIUM | Royal Elementor Addons < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notifica |
| CVE-2026-84906 | 5.3 MEDIUM | Eventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transa |
| CVE-2026-86475 | 5.3 MEDIUM | Appointment Hour Booking < 1.5.95 - Unauthenticated Booking Capacity Bypass via Multi-Appo |
| CVE-2026-19857 | 4.8 MEDIUM | Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Cu |
| CVE-2026-76552 | WP Import Export Lite < 3.9.33 - Authenticated Arbitrary File Upload via Remote Image Impo | |
| CVE-2026-84907 | Eventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpoi | |
| CVE-2026-76555 | WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File | |
| CVE-2026-76557 | WP Import Export Lite < 3.9.33 - Authenticated SQLi via Import Options | |
| CVE-2026-76551 | WP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP Function | |
| CVE-2026-74926 | MultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via | |
| CVE-2026-76553 | WP Import Export Lite < 3.9.33 - Authenticated Arbitrary Directory Deletion via Template P | |
| CVE-2026-78472 | Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated SQLi via 'sort' Parameter | |
| CVE-2026-82124 | Schema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Con | |
| CVE-2026-77702 | Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token | |
| CVE-2026-84829 | Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter | |
| CVE-2026-84905 | Eventin < 4.1.24 - Contributor+ User Creation via Speaker Creation | |
| CVE-2026-84088 | Xpro Elementor Addons < 1.7.9 - Contributor+ Stored XSS via Interactive Circle Widget | |
| CVE-2026-82126 | Schema & Structured Data for WP & AMP 1.63 - 1.65 - Contributor+ Non-Public Post Content D | |
| CVE-2026-82125 | Schema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Con | |
| CVE-2026-76550 | WP Import Export Lite < 3.9.34 - Authenticated RCE via Export Template Path Traversal |
Showing top 20 of 46 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Subscriptions for WooCommerce
-
CVE-2026-87860
Subscriptions for WooCommerce < 2.0.3 - Subscription Cancell -
CVE-2026-15211
Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via A -
CVE-2026-15215
Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitr -
CVE-2026-15214
Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscrip -
CVE-2026-15414
Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Cont
Same vendor: Unknown
-
CVE-2026-92540
Import and export users and customers < 2.5.2 - Custom Role -
CVE-2026-92541
Import and export users and customers < 2.5.2 - Custom Role -
CVE-2026-92965
TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption -
CVE-2026-92422
Meow Gallery < 5.5.5 - Unauthenticated Arbitrary Shortcode E -
CVE-2026-92423
Meow Gallery < 5.5.5 - Author+ Draft and Private Post Disclo
V. Comments for CVE-2026-87854
No comments yet