CVE-2026-15211 WooCommerce CVE debrief

Who should care

Administrators of WooCommerce sites using the Subscriptions for WooCommerce plugin, especially those allowing guest checkout, should be aware of this vulnerability and take steps to protect their sites. This includes reviewing and applying the vendor's patch, restricting access to sensitive order completion functionality, and monitoring for suspicious order activity. Additionally, security teams and vulnerability management teams should prioritize this vulnerability given its CVSS score of 5.9 and potential for financial loss through unauthorized order completion. Platform operators and affected product deployments should also be aware of the potential impact and take necessary precautions to mitigate the vulnerability.

Technical summary

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow. This allows an attacker to substitute an approved, uncaptured PayPal order token and have an expensive order marked paid without paying its price. The plugin's vulnerability affects WooCommerce sites using guest checkout, allowing unauthenticated attackers to exploit this issue. To address this, site administrators should review and apply the vendor's patch for the Subscriptions for WooCommerce WordPress plugin version 2.0.1 or later.

Defensive priority

Medium priority given the CVSS score of 5.9 and the potential for financial loss through unauthorized order completion.

Recommended defensive actions

• Review and apply the vendor's patch for the Subscriptions for WooCommerce WordPress plugin version 2.0.1 or later.
• Restrict access to sensitive order completion functionality.
• Monitor for suspicious order activity and implement additional authentication for guest checkout.
• Confirm whether affected WooCommerce sites exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is COMPLETED, without comparing the captured amount to the order total. Evidence from the NVD and WPScan indicates a vulnerability in the Subscriptions for WooCommerce WordPress plugin. Limited details are available on affected versions and patched releases. The CVE record was published on 2026-08-07T08:16:45.780Z and has not been modified since then. The NVD entry is currently Deferred. To verify, defenders should review the official CVE record and NVD entry for accuracy.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.