What is CVE-2026-15397?
CVE-2026-15397 is a critical Missing Authorization vulnerability in the "Subscriptions for WooCommerce" plugin for WordPress. Affecting versions up to and including 2.0.0, it allows authenticated users to perform unauthorized actions via the `wps_sfw_install_plugin_configuration` AJAX handler. Immediate update to the latest version is strongly recommended.
Azərbaycanca: CVE-2026-15397 WordPress üçün "Subscriptions for WooCommerce" plaginində aşkar edilmiş kritik "Missing Authorization" zəifliyidir. 2.0.0 və daha əvvəlki versiyalara təsir edir və autentifikasiya olunmuş istifadəçilərə `wps_sfw_install_plugin_configuration` AJAX funksiyası vasitəsilə icazəsiz əməliyyatlar aparmağa imkan verə bilər. Dərhal plaqini ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-862
FAQ2
Which WordPress plugin is affected by vulnerability CVE-2026-15397?
CVE-2026-15397 affects the "Subscriptions for WooCommerce" plugin.
Is authentication required to exploit this vulnerability?
Yes, CVE-2026-15397 can allow authenticated users to perform unauthorized actions.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.