PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-56061 WP Swings CVE debrief

CVE-2026-56061 is a HIGH-severity vulnerability in Subscriptions for WooCommerce plugin versions <= 1.9.5. This vulnerability allows unauthenticated broken access control, potentially enabling attackers to manipulate subscriptions. The CVSS score for this vulnerability is 7.5. The vulnerability was published on June 26, 2026, and last modified on June 29, 2026. Users of affected versions should apply patches or mitigations as soon as possible.

Vendor
WP Swings
Product
Subscriptions for WooCommerce
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-26
Original CVE updated
2026-06-29
Advisory published
2026-06-26
Advisory updated
2026-06-29

Who should care

Administrators and security teams of WordPress installations using Subscriptions for WooCommerce plugin versions <= 1.9.5 should prioritize patching this vulnerability. Given the HIGH severity and potential for exploitation, swift action is recommended. This vulnerability could impact e-commerce sites relying on WooCommerce subscriptions.

Technical summary

CVE-2026-56061 is a broken access control vulnerability in the Subscriptions for WooCommerce plugin. The vulnerability is rated HIGH with a CVSS score of 7.5. It allows unauthenticated access, which could lead to unauthorized manipulation of subscriptions. The vulnerability was introduced in plugin versions <= 1.9.5. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Defensive priority

High priority should be given to patching CVE-2026-56061 due to its HIGH CVSS severity and potential for exploitation. Immediate action is recommended for WordPress sites using affected plugin versions.

Recommended defensive actions

  • Apply the latest patch or update to Subscriptions for WooCommerce plugin version > 1.9.5.
  • Review and restrict access controls for subscriptions management.
  • Monitor subscription changes and anomalies.
  • Implement Web Application Firewall (WAF) rules to detect suspicious activities.
  • Perform regular security audits and vulnerability assessments.

Evidence notes

The CVE-2026-56061 vulnerability details were obtained from official sources, including CVE.org and NVD. The vulnerability is confirmed to exist in Subscriptions for WooCommerce plugin versions <= 1.9.5. The CVSS score and vector were provided by official vulnerability databases.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-56061 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-56061

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-56061 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56061

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.