# Autoship Cloud for WooCommerce Subscription Products <= 2.17.1 - Unauthenticated Missing Authorization to Product Scheduled Order Availability Update via REST API

- **ID:** WPSEC-2026-2511
- **Plugin:** Autoship Cloud for WooCommerce Subscription Products (`autoship-cloud`), https://wordpress.org/plugins/autoship-cloud/
- **Affected versions:** all versions before 2.18.0
- **Fixed in:** 2.18.0 (Update to 2.18.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/autoship-cloud
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2511/

## Description

The Autoship Cloud for WooCommerce Subscription Products plugin for WordPress is vulnerable to unauthorized modification of data via the 'autoshipcloud/v1/product/{id}' REST endpoint in all versions up to, and including, 2.17.1, due to its permission callback (autoship_qpilot_products_permissions) allowing every request by default. This makes it possible for unauthenticated attackers to turn the 'Add to Scheduled Order' and 'Process on Scheduled Order' availability settings of any simple product, variable product or variation on or off. The plugin's connection health check endpoints under the same namespace were also open to anonymous requests, but they only record timestamps.

## References

- https://wpsec.com/vuln/WPSEC-2026-2511/
- https://plugins.svn.wordpress.org/autoship-cloud/tags/2.18.0/
- https://wordpress.org/plugins/autoship-cloud/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2511/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.