Subscription & Recurring Payment for WooCommerce <= 2.5.1 - Unauthenticated Insecure Direct Object Reference via Guest Checkout Billing Email
- ID
- WPSEC-2026-2949
- Plugin
- Subscriptions for WooCommerce with Stripe Recurring Payments (subscription)
- Affected
- from 1.8.0 before 2.5.2
- Remediation
- Update to 2.5.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Subscription & Recurring Payment for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Subscriptions for WooCommerce with Stripe Recurring Payments plugin for WordPress is vulnerable to Insecure Direct Object Reference via guest checkout in all versions up to, and including, 2.5.1, due to the guest checkout account handling looking up an existing user by the billing email and assigning the order and subscription to that account without the owner logging in. This makes it possible for unauthenticated attackers, when guest subscription checkout is enabled and login is not enforced, to attach orders and subscriptions to another user's account. Through the plugin's subscription role management, this lets them change the role of that user (administrators excepted), for example demoting an editor or shop manager.
References
- https://wpsec.com/vuln/WPSEC-2026-2949/
- https://plugins.svn.wordpress.org/subscription/tags/2.5.2/
- https://wordpress.org/plugins/subscription/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS