{
 "id": "WPSEC-2026-2511",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2511/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2511/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2511/index.md",
 "title": "Autoship Cloud for WooCommerce Subscription Products <= 2.17.1 - Unauthenticated Missing Authorization to Product Scheduled Order Availability Update via REST API",
 "description": "The Autoship Cloud for WooCommerce Subscription Products plugin for WordPress is vulnerable to unauthorized modification of data via the 'autoshipcloud/v1/product/{id}' REST endpoint in all versions up to, and including, 2.17.1, due to its permission callback (autoship_qpilot_products_permissions) allowing every request by default. This makes it possible for unauthenticated attackers to turn the 'Add to Scheduled Order' and 'Process on Scheduled Order' availability settings of any simple product, variable product or variation on or off. The plugin's connection health check endpoints under the same namespace were also open to anonymous requests, but they only record timestamps.",
 "plugin": {
  "slug": "autoship-cloud",
  "name": "Autoship Cloud for WooCommerce Subscription Products",
  "full_name": "Autoship Cloud for WooCommerce Subscription Products",
  "wordpress_org": "https://wordpress.org/plugins/autoship-cloud/",
  "advisories_url": "https://wpsec.com/vuln/plugin/autoship-cloud/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/autoship-cloud"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.18.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.18.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.18.0",
 "remediation": "Update to 2.18.0 or later.",
 "fix_released": "2026-11-03T17:28:24+00:00",
 "published": "2026-11-04T17:48:32+00:00",
 "updated": "2026-11-04T13:59:00.464575+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2511/",
  "https://plugins.svn.wordpress.org/autoship-cloud/tags/2.18.0/",
  "https://wordpress.org/plugins/autoship-cloud/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/autoship-cloud",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-04"
 }
}