Unknown Subscriptions For Woocommerce vulnerabilities

5 CVEs affecting Unknown Subscriptions For Woocommerce, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-87860, published 2026-09-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-15215, published 2026-08-07. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1…
CVE-2026-87854, published 2026-09-16. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the…
CVE-2026-15214, published 2026-08-07. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer…
CVE-2026-87860, published 2026-09-16. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel…
CVE-2026-15211, published 2026-08-07. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received…