CVE-2026-15215: Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) to install and activate arbitrary Subscriptions for WooCommerce WordPress plugin before 2.0.1, resulting in remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Subscriptions for WooCommerce WordPress pluginto a version that resolves this vulnerability.Fixed in 2.0.1 - Compensating control
Restrict access so only users who have Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities can install and activate Subscriptions for WooCommerce WordPress plugins via the nonce-protected AJAX action (e.g., limit the relevant capability to Administrators and exclude the Shop Manager role).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15215?
CVE-2026-15215 has a risk rating of 77, indicating a high level of severity.
What are the potential impacts of CVE-2026-15215?
CVE-2026-15215 allows users with the Shop Manager role to install and activate arbitrary plugins, posing a significant security risk.
How do I fix CVE-2026-15215?
To mitigate CVE-2026-15215, upgrade the Subscriptions for WooCommerce plugin to version 2.0.1 or later.
Who is affected by CVE-2026-15215?
CVE-2026-15215 affects users of the Subscriptions for WooCommerce plugin version prior to 2.0.1.
What is the nature of the vulnerability in CVE-2026-15215?
CVE-2026-15215 is an arbitrary plugin installation vulnerability due to insufficient capability verification.