What is CVE-2026-15214?
The Subscriptions for WooCommerce WordPress plugin before version 2.0.1 fails to verify subscription ownership, allowing any authenticated customer to view another customer's subscription details (product, status, dates). Update the plugin to version 2.0.1 or later.
Azərbaycanca: Subscriptions for WooCommerce WordPress plaginində (2.0.1-dən əvvəl) autentifikasiya olunmuş istənilən müştəri digər müştərinin abunəlik məlumatlarını (məhsul, status, tarixlər) görə bilər. Plagin 2.0.1 və ya daha yeni versiyaya yenilənməlidir.
Related CVEs
link basis: same weakness class CWE-862
FAQ2
Who is affected by the CVE-2026-15214 vulnerability in the "Subscriptions for WooCommerce" plugin?
Any authenticated customer is affected, as the plugin fails to verify subscription ownership, allowing one customer to view another customer's subscription details.
What should users do to mitigate the CVE-2026-15214 vulnerability?
Users should update the "Subscriptions for WooCommerce" plugin to version 2.0.1 or later.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.