CVE-2026-1926: Wpswings Subscriptions For Woocommerce

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `wps_sfw_admin_cancel_susbcription()` function in all versions up to, and including, 1.9.2. This is due to the function being hooked to the `init` action without any authentication or authorization checks, and only performing a non-empty check on the nonce parameter without actually validating it via `wp_verify_nonce()`. This makes it possible for unauthenticated attackers to cancel any active WooCommerce subscription by sending a crafted GET request with an arbitrary nonce value via the `wps_subscription_id` parameter.

Affected products

• Wpswings Subscriptions For Woocommerce: up to and including 1.9.2

Published 2026-03-18. Last modified 2026-06-17.