{"id":"CVE-2026-15215","aliases":["EUVD-2026-54380","GHSA-m77w-m8qm-q9pv"],"status":"published","title":"Subscriptions for WooCommerce \u003c 2.0.1 - Shop Manager+ Arbitrary Plugin Installation","description":"The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) to install and activate arbitrary Subscriptions for WooCommerce WordPress plugin before 2.0.1, resulting in remote code execution.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00636,"percentile":0.50764,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2026-08-07T06:00:11Z","modified":"2026-08-26T16:31:16Z","products":[{"vendor":"unknown","product":"subscriptions for woocommerce"},{"vendor":"wp swings","product":"subscriptions for woocommerce"}],"references":[{"url":"https://wpscan.com/vulnerability/dad30b9f-1c50-4d0e-baa0-9bce2f5a7db5/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15215"},{"url":"https://wpscan.com/vulnerability/dad30b9f-1c50-4d0e-baa0-9bce2f5a7db5"},{"url":"https://github.com/advisories/GHSA-m77w-m8qm-q9pv"}],"sources":{"cve":[{"id":"CVE-2026-15215","title":"Subscriptions for WooCommerce \u003c 2.0.1 - Shop Manager+ Arbitrary Plugin Installation","description":"The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) to install and activate arbitrary Subscriptions for WooCommerce WordPress plugin before 2.0.1, resulting in remote code execution.","status":"published","published":"2026-08-07T06:00:11.8Z","modified":"2026-08-07T18:12:36.214Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T13:47:51.033687Z"}],"euvd":[{"id":"EUVD-2026-54380","description":"The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) to install and activate arbitrary Subscriptions for WooCommerce WordPress plugin before 2.0.1, resulting in remote code execution.","status":"published","published":"2026-08-07T06:00:11Z","modified":"2026-08-07T18:12:36Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:06.573967Z"}],"ghsa":[{"id":"GHSA-m77w-m8qm-q9pv","title":"The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's...","description":"The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) to install and activate arbitrary Subscriptions for WooCommerce WordPress plugin before 2.0.1, resulting in remote code execution.","status":"published","published":"2026-08-07T06:30:28Z","modified":"2026-08-07T21:30:33Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:10:12.306859Z"}],"nvd":[{"id":"CVE-2026-15215","description":"The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) to install and activate arbitrary Subscriptions for WooCommerce WordPress plugin before 2.0.1, resulting in remote code execution.","status":"published","published":"2026-08-07T06:16:55.227Z","modified":"2026-08-26T16:31:16.753Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:12:35.386166Z"}]}}