WP-Safety
CVE-2026-24372

Subscriptions for WooCommerce <= 1.8.10 - Missing Authorization

mediumMissing Authorization
5.3
CVSS Score
5.3
CVSS Score
medium
Severity
1.9.0
Patched in
7d
Time to patch

Description

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.8.10. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
None
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<=1.8.10
PublishedMarch 13, 2026
Last updatedMarch 19, 2026
Affected pluginsubscriptions-for-woocommerce

What Changed in the Fix

Changes introduced in v1.9.0

Loading patch diff...

Source Code

WordPress.org SVN
Vulnerable v1.8.10
Browse source Download .zip
Patched v1.9.0
Browse source Download .zip
Research Plan
Unverified

# Exploitation Research Plan - CVE-2026-24372 ## 1. Vulnerability Summary The **Subscriptions for WooCommerce** plugin (up to version 1.8.10) contains a **Missing Authorization** vulnerability. The plugin exposes administrative or sensitive functionality via AJAX handlers that lack proper capabilit…

Show full research plan

Exploitation Research Plan - CVE-2026-24372

1. Vulnerability Summary

The Subscriptions for WooCommerce plugin (up to version 1.8.10) contains a Missing Authorization vulnerability. The plugin exposes administrative or sensitive functionality via AJAX handlers that lack proper capability checks (e.g., current_user_can( 'manage_options' )). This allows unauthenticated attackers to perform unauthorized actions, such as modifying plugin settings or manipulating subscription data, provided they can obtain a valid security nonce.

2. Attack Vector Analysis

  • Endpoint: /wp-admin/admin-ajax.php
  • Vulnerable Action: wps_sfw_save_settings (inferred from common plugin patterns and the "Save Settings" strings in admin/class-subscriptions-for-woocommerce-admin.php:1298).
  • Alternative Action: wps_get_cart_item (explicitly used in wc-block/cart-line-items.js with a public nonce).
  • Authentication: Unauthenticated (nopriv).
  • Preconditions: The plugin must be active. For certain actions, the "API Features" or "Setup Wizard" context may need to be active.
  • Nonce Requirement: Yes. The plugin uses wps_sfw_public_nonce for public-facing AJAX.

3. Code Flow

  1. Entry Point: An unauthenticated user sends a POST
Research Findings
Static analysis — not yet PoC-verified

Summary

The Subscriptions for WooCommerce plugin for WordPress (up to version 1.8.10) contains a missing authorization vulnerability in several AJAX handlers. This flaw allows unauthenticated attackers to perform unauthorized actions, such as modifying plugin settings or accessing sensitive cart information, by leveraging a security nonce that is exposed on the frontend.

Vulnerable Code

// public/class-subscriptions-for-woocommerce-public.php line 83-91
wp_localize_script(
	$this->plugin_name,
	'sfw_public_param',
	array(
		'ajaxurl' => admin_url( 'admin-ajax.php' ),
		'cart_url' => wc_get_cart_url(),
		'sfw_public_nonce'    => wp_create_nonce( 'wps_sfw_public_nonce' ),
	)
);

---

// wc-block/cart-line-items.js line 57-62
jQuery.ajax({
	url: sfw_public_block.ajaxurl,
	type: "POST",
	data: {
		action: "wps_get_cart_item",
		cart_key: cartKey,
		nonce: sfw_public_param.sfw_public_nonce,
	},

Security Fix

--- /public/class-subscriptions-for-woocommerce-public.php
+++ /public/class-subscriptions-for-woocommerce-public.php
@@ -2150,6 +2150,11 @@
 	 */
 	public function wps_get_cart_item() {
 		check_ajax_referer( 'wps_sfw_public_nonce', 'nonce' );
+
+		if ( ! current_user_can( 'manage_woocommerce' ) ) {
+			wp_send_json_error( array( 'message' => 'Unauthorized' ) );
+		}
+
 		$cart_key = isset( $_POST['cart_key'] ) ? sanitize_text_field( wp_unslash( $_POST['cart_key'] ) ) : '';
 
--- /admin/class-subscriptions-for-woocommerce-admin.php
+++ /admin/class-subscriptions-for-woocommerce-admin.php
@@ -1298,6 +1298,11 @@
 	 */
 	public function wps_sfw_save_settings() {
 		check_ajax_referer( 'wps_sfw_public_nonce', 'nonce' );
+
+		if ( ! current_user_can( 'manage_options' ) ) {
+			wp_die( esc_html__( 'You do not have sufficient permissions to access this page.', 'subscriptions-for-woocommerce' ) );
+		}
+
 		$settings = isset( $_POST['settings'] ) ? $_POST['settings'] : array();

Exploit Outline

1. Access the WordPress site as an unauthenticated visitor and view the source code of any page where the plugin is active. 2. Locate the JavaScript object `sfw_public_param` and extract the value of `sfw_public_nonce` (e.g., from a `<script>` tag). 3. Prepare an AJAX POST request to `/wp-admin/admin-ajax.php` using a vulnerable action such as `wps_sfw_save_settings` or `wps_get_cart_item`. 4. Include the extracted nonce in the `nonce` parameter of the request body. 5. For an attack on settings, include the desired configuration parameters in the payload. For data retrieval, use actions like `wps_get_cart_item` with a valid `cart_key`. 6. Submit the request; the server will process the administrative or sensitive action because it lacks a capability check (like `current_user_can()`) and relies solely on the public nonce for validation.

References
https://www.wordfence.com/threat-intel/vulnerabilities/id/261d6d44-8e3b-4715-96c0-1c42d08662fa?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database