Authorization Flaw in Chargely Free Subscriptions for WooCommerce by WordPress
CVE-2026-116528

Currently unrated

Key Information:

Vendor

WordPress
Status
Chargely Free Subscriptions For Woocommernce
Vendor
CVE Published:
14 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-116528?

The Chargely Free Subscriptions for WooCommerce plugin prior to version 1.0 has a security concern where it fails to implement necessary authorization checks on a REST API endpoint. This oversight allows attackers without authentication to access sensitive configuration details, including the WooCommerce REST API consumer key and secret. These credentials provide full read and write privileges, posing a significant risk to WooCommerce stores. Website owners using this plugin should ensure they update to a secure version to mitigate potential exploits.

Affected Version(s)

Chargely Free Subscriptions For Woocommernce 0 <= 1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-116528 - Proof of Concept

References

https://wpscan.com/vulnerability/423af746-a5a6-4eb5-a4ac-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Naoki Kawahigashi
WPScan
.