Unauthorized Data Modification in Subscriptions for WooCommerce Plugin by Vendor WordPress

CVE-2026-1926

What is CVE-2026-1926?

The Subscriptions for WooCommerce plugin for WordPress is susceptible to unauthorized data modification. This vulnerability arises from a missing capability check on the function responsible for canceling subscriptions. The function, which is linked to the init action, lacks proper authentication and authorization controls, only conducting a superficial check on the nonce parameter without validating it through the wp_verify_nonce() method. Consequently, unauthorized attackers can exploit this flaw to cancel active subscriptions by issuing a specially crafted GET request with a manipulated nonce value.

References