{
 "id": "WPSEC-2026-2949",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2949/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2949/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2949/index.md",
 "title": "Subscription & Recurring Payment for WooCommerce <= 2.5.1 - Unauthenticated Insecure Direct Object Reference via Guest Checkout Billing Email",
 "description": "The Subscriptions for WooCommerce with Stripe Recurring Payments plugin for WordPress is vulnerable to Insecure Direct Object Reference via guest checkout in all versions up to, and including, 2.5.1, due to the guest checkout account handling looking up an existing user by the billing email and assigning the order and subscription to that account without the owner logging in. This makes it possible for unauthenticated attackers, when guest subscription checkout is enabled and login is not enforced, to attach orders and subscriptions to another user's account. Through the plugin's subscription role management, this lets them change the role of that user (administrators excepted), for example demoting an editor or shop manager.",
 "plugin": {
  "slug": "subscription",
  "name": "Subscription & Recurring Payment for WooCommerce",
  "full_name": "Subscriptions for WooCommerce with Stripe Recurring Payments",
  "wordpress_org": "https://wordpress.org/plugins/subscription/",
  "advisories_url": "https://wpsec.com/vuln/plugin/subscription/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/subscription"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.8.0",
    "from_inclusive": true,
    "to": "2.5.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.8.0 before 2.5.2"
  ]
 },
 "introduced_in": "1.8.0",
 "fixed_in": "2.5.2",
 "remediation": "Update to 2.5.2 or later.",
 "fix_released": "2026-11-11T05:59:48+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:11:28.078070+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2949/",
  "https://plugins.svn.wordpress.org/subscription/tags/2.5.2/",
  "https://wordpress.org/plugins/subscription/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/subscription",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}