# YITH WooCommerce Subscription <= 4.22.0 - Unauthenticated Limited Information Exposure via REST API

- **ID:** WPSEC-2026-2592
- **Plugin:** YITH WooCommerce Subscription (`yith-woocommerce-subscription`), https://wordpress.org/plugins/yith-woocommerce-subscription/
- **Affected versions:** from 2.0.0 before 4.23.0
- **Fixed in:** 4.23.0 (Update to 4.23.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/yith-woocommerce-subscription
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2592/

## Description

The YITH WooCommerce Subscription plugin for WordPress is vulnerable to Limited Information Exposure via the WordPress REST API in all versions up to, and including, 4.22.0. This is due to the non-public subscription post type (ywsbs_subscription) being registered with 'show_in_rest' enabled while its records are stored with the 'publish' status, which made the core wp/v2 posts endpoints list and return them without a capability check. This makes it possible for unauthenticated attackers to enumerate subscription records and get their IDs, creation and modification dates, slugs and links, which shows how many subscriptions the store has and when they were created or changed.

## References

- https://wpsec.com/vuln/WPSEC-2026-2592/
- https://plugins.svn.wordpress.org/yith-woocommerce-subscription/tags/4.23.0/
- https://wordpress.org/plugins/yith-woocommerce-subscription/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2592/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.