CVE-2026-87854: WooCommerce Subscriptions Info Disclosure

CVE-2026-87854 Overview

CVE-2026-87854 affects the Subscriptions for WooCommerce WordPress plugin in versions prior to 2.0.3. The plugin fails to correctly validate the shared secret protecting one of its REST endpoints. Unauthenticated attackers can query the endpoint and retrieve the store's complete subscription list. Exposed data includes customer usernames, product names, recurring payment amounts, and payment dates. The issue is classified as an information exposure weakness under [CWE-200].

Critical Impact
Unauthenticated remote attackers can enumerate every subscription record in a WooCommerce store, exposing customer identifiers and billing details usable for phishing and fraud.

Affected Products

Subscriptions for WooCommerce WordPress plugin versions prior to 2.0.3
WordPress sites running WooCommerce with the vulnerable plugin installed
Any customer subscription records stored by the plugin

Discovery Timeline

2026-09-16 - CVE-2026-87854 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-87854

Vulnerability Analysis

The Subscriptions for WooCommerce plugin exposes a REST API endpoint intended for internal or partner integrations. Access to this endpoint is gated by a shared secret token. The validation routine does not compare the supplied secret against the stored value correctly, allowing requests with an invalid or missing secret to succeed. Once past this broken check, the endpoint returns the store's full subscription dataset in a single response.

Because the endpoint is served over HTTPS on the WordPress REST API, attackers only need network access to the target site. No user account, session, or user interaction is required. The response body discloses customer usernames, subscribed product names, recurring billing amounts, and scheduled payment dates.

Root Cause

The defect lies in the endpoint's permission callback. The plugin accepts the shared secret from the request but performs the comparison in a way that does not enforce a match, effectively bypassing authentication. This is a classic information exposure flaw [CWE-200] rooted in improper access control on a REST route.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to the plugin's REST endpoint on the target WordPress site. The broken secret check returns the full subscription collection as JSON. The attacker parses the response to harvest personally identifiable information (PII) and financial details for targeted phishing, account takeover, or fraud campaigns.

Refer to the WPScan Vulnerability Analysis for endpoint specifics.

Detection Methods for CVE-2026-87854

Indicators of Compromise

Repeated unauthenticated HTTP GET requests to the plugin's REST endpoint under /wp-json/ from unfamiliar IP addresses
Large JSON responses returned to unauthenticated clients containing subscription fields such as usernames, products, and payment dates
User agents associated with scanners or scripted clients accessing WooCommerce REST routes outside normal admin traffic

Detection Strategies

Review web server access logs for requests targeting the Subscriptions for WooCommerce REST route without an authenticated session cookie
Alert on anomalous response sizes from the plugin's REST endpoint that exceed typical API responses
Correlate requests to the vulnerable endpoint with subsequent phishing reports from affected customers

Monitoring Recommendations

Enable WordPress and WooCommerce audit logging to capture REST API calls and their source IPs
Deploy a web application firewall (WAF) rule to log and rate-limit requests to /wp-json/ paths owned by the plugin
Monitor egress traffic patterns from the web tier for bulk exfiltration of JSON payloads

How to Mitigate CVE-2026-87854

Immediate Actions Required

Upgrade the Subscriptions for WooCommerce plugin to version 2.0.3 or later on all WordPress sites
Rotate any shared secrets or integration tokens previously configured for the plugin's REST endpoints
Notify affected customers if logs indicate the vulnerable endpoint was accessed by untrusted clients

Patch Information

The vendor addressed the flaw in Subscriptions for WooCommerce version 2.0.3. The fix corrects validation of the shared secret protecting the affected REST endpoint. Consult the WPScan Vulnerability Analysis for advisory details and version references.

Workarounds

Restrict access to the WordPress REST API using a WAF or reverse proxy rule that blocks unauthenticated requests to the plugin's route
Temporarily deactivate the Subscriptions for WooCommerce plugin if patching is not immediately possible
Enforce IP allow-listing on the affected REST endpoint at the web server or firewall layer until the update is applied

bash

# Example nginx rule to block unauthenticated access to the plugin REST route
location ~ ^/wp-json/subscriptions-for-woocommerce/ {
    allow 203.0.113.0/24;   # trusted integration network
    deny all;
}