CVE-2026-87856 PUBLISHED

Subscriptions for WooCommerce 2.0.0 - 2.1.0 - Unauthenticated Membership Content Restriction Bypass

Assigner: WPScan
Reserved: 09.09.2026 Published: 05.11.2026 Updated: 05.11.2026

The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on standard front-end page views, allowing unauthenticated users to read the full contents of restricted posts and pages through other routes that render the same content.

Product Status

Vendor Unknown
Product Subscriptions for WooCommerce
Versions Default: unaffected
  • affected from 2.0.0 to 2.1.1 (excl.)

Credits

  • Karthik Ramakrishnan finder
  • WPScan coordinator

References

Problem Types

  • CWE-284 Improper Access Control CWE