Autoship Cloud for WooCommerce Subscription Products <= 2.17.1 - Unauthenticated Missing Authorization to Product Scheduled Order Availability Update via REST API
- ID
- WPSEC-2026-2511
- Plugin
- Autoship Cloud for WooCommerce Subscription Products (autoship-cloud)
- Affected
- all versions before 2.18.0
- Remediation
- Update to 2.18.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-04
- Attack surface
- Autoship Cloud for WooCommerce Subscription Products on WPSec AttackSurface
- Fix released
- Published
Description
The Autoship Cloud for WooCommerce Subscription Products plugin for WordPress is vulnerable to unauthorized modification of data via the 'autoshipcloud/v1/product/{id}' REST endpoint in all versions up to, and including, 2.17.1, due to its permission callback (autoship_qpilot_products_permissions) allowing every request by default. This makes it possible for unauthenticated attackers to turn the 'Add to Scheduled Order' and 'Process on Scheduled Order' availability settings of any simple product, variable product or variation on or off. The plugin's connection health check endpoints under the same namespace were also open to anonymous requests, but they only record timestamps.
References
- https://wpsec.com/vuln/WPSEC-2026-2511/
- https://plugins.svn.wordpress.org/autoship-cloud/tags/2.18.0/
- https://wordpress.org/plugins/autoship-cloud/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS