CVE-2026-15397: Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via the wpssfwinstallpluginconfiguration AJAX handler. This makes it possible for authenticated attackers, with shop manager-level access and above, to install and activate arbitrary WordPress.org plugins.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Subscriptions for WooCommerceto a version that resolves this vulnerability.Fixed in 2.0.0 - Compensating control
Limit WordPress admin/dashboard (and any endpoints that can trigger wps_sfw_install_plugin_configuration) so only fully trusted staff/accounts can access it, because the issue affects authenticated users with Shop Manager+ access.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15397?
The severity of CVE-2026-15397 is rated high with a score of 7.2.
How do I fix CVE-2026-15397?
To fix CVE-2026-15397, update the Subscriptions for WooCommerce plugin to version 2.0.1 or later.
What type of vulnerability is CVE-2026-15397?
CVE-2026-15397 is a Missing Authorization vulnerability that allows authenticated users to perform unauthorized actions.
What systems are affected by CVE-2026-15397?
CVE-2026-15397 affects all versions of the Subscriptions for WooCommerce plugin up to and including 2.0.0.
What can attackers do with CVE-2026-15397?
Attackers can exploit CVE-2026-15397 to install arbitrary plugins through the wps_sfw_install_plugin_configuration AJAX action.