YITH WooCommerce Subscription <= 4.22.0 - Unauthenticated Limited Information Exposure via REST API
- ID
- WPSEC-2026-2592
- Plugin
- YITH WooCommerce Subscription (yith-woocommerce-subscription)
- Affected
- from 2.0.0 before 4.23.0
- Remediation
- Update to 4.23.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-05
- Attack surface
- YITH WooCommerce Subscription on WPSec AttackSurface
- Fix released
- Published
Description
The YITH WooCommerce Subscription plugin for WordPress is vulnerable to Limited Information Exposure via the WordPress REST API in all versions up to, and including, 4.22.0. This is due to the non-public subscription post type (ywsbs_subscription) being registered with 'show_in_rest' enabled while its records are stored with the 'publish' status, which made the core wp/v2 posts endpoints list and return them without a capability check. This makes it possible for unauthenticated attackers to enumerate subscription records and get their IDs, creation and modification dates, slugs and links, which shows how many subscriptions the store has and when they were created or changed.
References
- https://wpsec.com/vuln/WPSEC-2026-2592/
- https://plugins.svn.wordpress.org/yith-woocommerce-subscription/tags/4.23.0/
- https://wordpress.org/plugins/yith-woocommerce-subscription/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS