# Subscriptions for WooCommerce <= 2.1.0 - Unauthenticated Restricted Content Exposure via Redirect-Behavior Membership Rules

- **ID:** WPSEC-2026-2060
- **Plugin:** Subscriptions for WooCommerce (`subscriptions-for-woocommerce`), https://wordpress.org/plugins/subscriptions-for-woocommerce/
- **Affected versions:** from 2.0.0 before 2.1.1
- **Fixed in:** 2.1.1 (Update to 2.1.1 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-284
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/subscriptions-for-woocommerce
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2060/

## Description

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to unauthorized access to restricted content via the membership restriction enforcer's the_content filter in versions 2.0.0 up to, and including, 2.1.0. When an access rule uses the 'redirect' behavior and a redirect URL is set, the filter returns the full protected post content. It relies on a template_redirect handler to send visitors away, but that handler only runs on singular front-end page loads. It does not run for REST API responses, feeds, home, archive and search pages, or secondary loops. This makes it possible for unauthenticated attackers to read members-only post content through those channels when a redirect-behavior restriction rule is in use.

## References

- https://wpsec.com/vuln/WPSEC-2026-2060/
- https://plugins.svn.wordpress.org/subscriptions-for-woocommerce/tags/2.1.1/
- https://wordpress.org/plugins/subscriptions-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2060/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.