Subscriptions for WooCommerce <= 2.1.0 - Unauthenticated Restricted Content Exposure via Redirect-Behavior Membership Rules
- ID
- WPSEC-2026-2060
- Plugin
- Subscriptions for WooCommerce (subscriptions-for-woocommerce)
- Affected
- from 2.0.0 before 2.1.1
- Remediation
- Update to 2.1.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-284
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-30
- Attack surface
- Subscriptions for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to unauthorized access to restricted content via the membership restriction enforcer's the_content filter in versions 2.0.0 up to, and including, 2.1.0. When an access rule uses the 'redirect' behavior and a redirect URL is set, the filter returns the full protected post content. It relies on a template_redirect handler to send visitors away, but that handler only runs on singular front-end page loads. It does not run for REST API responses, feeds, home, archive and search pages, or secondary loops. This makes it possible for unauthenticated attackers to read members-only post content through those channels when a redirect-behavior restriction rule is in use.
References
- https://wpsec.com/vuln/WPSEC-2026-2060/
- https://plugins.svn.wordpress.org/subscriptions-for-woocommerce/tags/2.1.1/
- https://wordpress.org/plugins/subscriptions-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS