CVE-2026-87856: Subscriptions for WooCommerce 2.0.0 - 2.1.0 - Unauthenticated Membership Content Restriction Bypass

Published Nov 5, 2026

Updated

The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on standard front-end page views, allowing unauthenticated users to read the full contents of restricted posts and pages through other routes that render the same content.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Subscriptions for WooCommerce to a version that resolves this vulnerability.
Fixed in 2.1.1

Event History

Nov 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which installations are affected?

Installations using Subscriptions for WooCommerce versions before 2.1.1 are affected. The issue applies where membership restrictions are used to protect post or page content.

What does an attacker need to exploit this issue?

An attacker does not need to authenticate. They need to access a non-standard route that renders content from a restricted post or page rather than a standard front-end page view.

Are restricted posts and pages exposed by default?

The issue affects content protected by the plugin's membership content restrictions. Those restrictions are enforced for standard front-end page views, but not for other routes that render the same content.

What should be done if updating is not immediately possible?

The provided information does not identify a workaround. Until the plugin is updated to 2.1.1 or later, treat membership-restricted post and page content as potentially accessible through alternate rendering routes.

CVE-2026-87856: Subscriptions for WooCommerce 2.0.0 - 2.1.0 - Unauthenticated Membership Content Restriction Bypass

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

Are restricted posts and pages exposed by default?

What should be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

Are restricted posts and pages exposed by default?

What should be done if updating is not immediately possible?