CVE-2026-15414 wpswings CVE debrief

Who should care

Users of the Subscriptions for WooCommerce plugin, especially those with Contributor-level access or above, should be aware of this vulnerability and take immediate action to prevent potential privilege escalation attacks.

Technical summary

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the `save_meta_boxes()` function persisting the `_wps_plan_user_role` membership plan meta from `$_POST` without an allowlist that excludes privileged roles — the only validations applied, `sanitize_key()` and `wp_roles()->is_role()`, both accept `'administrator'` as a valid value, and the UI's `disabled` attribute on the role dropdown is a client-side-only control trivially bypassed via DevTools or a direct POST request; additionally, because the `wps_membership_plan` custom post type is registered with `capability_type => 'post'`, any user who can edit posts satisfies the `current_user_can('edit_post', $post_id)` guard in `save_meta_boxes()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their privileges to Administrator by storing `'administrator'` as the role granted on membership acquisition, which the Pro companion plugin then applies via `add_role()` during membership lifecycle events. Successful exploitation requires the Subscriptions for WooCommerce Pro companion plugin to be active, as it is the component that reads the stored `_wps_plan_user_role` meta via `get_post_meta()` and calls `add_role()` to apply the role during membership lifecycle events. Affected product deployments should review official advisories for validated scope and severity, and assign owners for follow-up on potential privilege escalation attacks. Immediate action is required to prevent potential attacks, especially for users with Contributor-level access or above. The vulnerability exists in plugin versions up to and including 2.0.0, and evidence of exploitation attempts should be monitored. Compensating controls, such as role-based access control and input validation, should be reviewed for exposed systems while remediation is scheduled and verified. Additional security measures, like monitoring and detection, should be implemented to track exceptions and retest remediated assets. This CVE record and NVD detail provide further context for defensive impact assessment and risk

Defensive priority

Authenticated attackers with Contributor-level access can potentially escalate privileges to Administrator. Immediate action is required to prevent potential privilege escalation attacks.

Recommended defensive actions

• Update the Subscriptions for WooCommerce plugin to the latest version.
• Restrict access to the plugin's settings and functionality.
• Monitor for suspicious activity and privilege escalation attempts.
• Implement additional security measures, such as role-based access control and input validation.
• Review official advisories for validated scope and severity.
• Assign owners for follow-up on potential privilege escalation attacks.
• Verify remediation through testing and monitoring.

Evidence notes

The vulnerability exists in the Subscriptions for WooCommerce plugin versions up to and including 2.0.0. The `save_meta_boxes()` function does not properly validate and sanitize user input, allowing authenticated attackers to escalate their privileges.

Official resources