Subscriptions for WooCommerce — Vulnerabilities & Security Advisories 10

All 10 CVE vulnerabilities found in Subscriptions for WooCommerce, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-87860	Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF	-	-	2026-09-16
CVE-2026-87854	Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass	-	-	2026-09-16
CVE-2026-15211	Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token	5.9	Medium	2026-08-07
CVE-2026-15214	Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOR	-	-	2026-08-07
CVE-2026-15215	Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation	-	-	2026-08-07
CVE-2026-15414	Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta CWE-269	8.8	High	2026-08-01
CVE-2026-15397	Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action CWE-862	7.2	High	2026-07-30
CVE-2026-56061	WordPress Subscriptions for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerability CWE-862	7.5	High	2026-06-26
CVE-2026-24372	WordPress Subscriptions for WooCommerce plugin <= 1.8.10 - Bypass Vulnerability vulnerability CWE-290	7.5	High	2026-03-25
CVE-2026-1926	Subscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation CWE-862	5.3	Medium	2026-03-18

All 10 known CVE vulnerabilities affecting Subscriptions for WooCommerce with full Chinese analysis, references, and POCs where available.