# Subscription & Recurring Payment for WooCommerce <= 2.5.1 - Unauthenticated Insecure Direct Object Reference via Guest Checkout Billing Email

- **ID:** WPSEC-2026-2949
- **Plugin:** Subscriptions for WooCommerce with Stripe Recurring Payments (`subscription`), https://wordpress.org/plugins/subscription/
- **Affected versions:** from 1.8.0 before 2.5.2
- **Fixed in:** 2.5.2 (Update to 2.5.2 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/subscription
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2949/

## Description

The Subscriptions for WooCommerce with Stripe Recurring Payments plugin for WordPress is vulnerable to Insecure Direct Object Reference via guest checkout in all versions up to, and including, 2.5.1, due to the guest checkout account handling looking up an existing user by the billing email and assigning the order and subscription to that account without the owner logging in. This makes it possible for unauthenticated attackers, when guest subscription checkout is enabled and login is not enforced, to attach orders and subscriptions to another user's account. Through the plugin's subscription role management, this lets them change the role of that user (administrators excepted), for example demoting an editor or shop manager.

## References

- https://wpsec.com/vuln/WPSEC-2026-2949/
- https://plugins.svn.wordpress.org/subscription/tags/2.5.2/
- https://wordpress.org/plugins/subscription/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2949/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.