CVE-2026-87854: Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass

Q: Who can exploit this issue?

Any unauthenticated remote user can retrieve subscription data if the affected REST endpoint is reachable. No valid shared secret is required because the plugin's secret validation can be bypassed.

Q: What information could be exposed?

The endpoint can disclose the store's full subscription list, including customer usernames, product names, recurring amounts, and payment dates.

Q: Which installations are affected?

Subscriptions for WooCommerce versions before 2.0.3 are affected. The issue concerns a REST endpoint protected by the plugin's shared-secret mechanism.

Q: How can an administrator determine whether the store is exposed?

Check the installed Subscriptions for WooCommerce version. Versions earlier than 2.0.3 should be treated as exposed, and access to the affected REST endpoint should be reviewed.

Published Sep 16, 2026

Updated

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and payment dates.

Event History

Sep 16, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote user can retrieve subscription data if the affected REST endpoint is reachable. No valid shared secret is required because the plugin's secret validation can be bypassed.

What information could be exposed?

The endpoint can disclose the store's full subscription list, including customer usernames, product names, recurring amounts, and payment dates.

Which installations are affected?

Subscriptions for WooCommerce versions before 2.0.3 are affected. The issue concerns a REST endpoint protected by the plugin's shared-secret mechanism.

How can an administrator determine whether the store is exposed?

Check the installed Subscriptions for WooCommerce version. Versions earlier than 2.0.3 should be treated as exposed, and access to the affected REST endpoint should be reviewed.