CVE-2026-87860: WooCommerce Subscriptions Auth Bypass Flaw

CVE-2026-87860 Overview

CVE-2026-87860 is a Cross-Site Request Forgery (CSRF) vulnerability in the Subscriptions for WooCommerce WordPress plugin before version 2.0.3. The plugin fails to verify a security token on requests that cancel a customer subscription. An attacker can craft a malicious request and trick a logged-in customer into loading it, causing the customer's own active subscription to be cancelled without consent. The flaw is tracked under CWE-862: Missing Authorization and affects site operators who rely on the plugin for recurring billing workflows.

Critical Impact
Attackers can force authenticated WooCommerce customers to cancel their own active subscriptions through a crafted request, disrupting recurring revenue and customer service continuity.

Affected Products

Subscriptions for WooCommerce WordPress plugin versions prior to 2.0.3
WordPress sites running WooCommerce with the vulnerable plugin installed
Customer accounts with active subscriptions managed by the plugin

Discovery Timeline

2026-09-16 - CVE-2026-87860 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-87860

Vulnerability Analysis

The Subscriptions for WooCommerce plugin exposes a subscription cancellation endpoint intended to be triggered by an authenticated customer from their account area. In versions before 2.0.3, this endpoint does not validate a WordPress nonce or equivalent anti-CSRF token before executing the cancellation action. Any authenticated session presenting the correct URL parameters is treated as a legitimate request.

Because the browser automatically sends the customer's authenticated session cookie with cross-origin requests, an attacker can host a malicious page containing an image tag, form, or script that fires the cancellation URL. When the victim visits that page while logged into the store, the cancellation executes under their identity. The impact is limited to integrity of the subscription state, with no direct disclosure of confidential data.

Root Cause

The root cause is missing authorization enforcement on a state-changing request, mapped to CWE-862. The cancellation handler relies solely on session authentication and does not require a wp_nonce or referrer check to prove the request originated from a trusted user interface. This violates the WordPress security model, which mandates nonce verification via check_admin_referer() or wp_verify_nonce() on all state-changing actions.

Attack Vector

Exploitation requires user interaction. An attacker crafts a page containing a hidden request targeting the cancellation endpoint and lures an authenticated customer to visit it through phishing, forum posts, or malicious advertising. When the victim's browser loads the attacker-controlled resource, the request executes with the customer's cookies attached. The attack works over the network without prior privileges on the target site. Refer to the WPScan Vulnerability Report for additional technical detail.

// No verified proof-of-concept code is published for CVE-2026-87860.
// See the WPScan advisory linked above for technical details.

Detection Methods for CVE-2026-87860

Indicators of Compromise

Unexpected subscription status changes to cancelled in the WooCommerce database without corresponding customer support tickets
Web server access logs showing cancellation endpoint hits with Referer headers pointing to unrelated external domains
Clusters of cancellations from authenticated customers within short time windows following email or forum campaigns

Detection Strategies

Review WooCommerce order and subscription audit logs for cancellation events that lack a matching session action from the My Account interface
Correlate POST and GET requests to the plugin's cancellation route against the originating Referer and Origin headers
Query the plugin database tables for subscription state transitions to cancelled and compare against installed plugin version < 2.0.3

Monitoring Recommendations

Enable WordPress activity logging to capture subscription lifecycle events with user, IP, and referer metadata
Alert on spikes in subscription cancellations that exceed baseline rates for the store
Monitor web application firewall logs for cancellation URL patterns originating from off-site referrers

How to Mitigate CVE-2026-87860

Immediate Actions Required

Upgrade the Subscriptions for WooCommerce plugin to version 2.0.3 or later on all affected WordPress sites
Audit subscription records for unauthorized cancellations since the plugin was installed and restore affected customers
Notify customers to log out of the store when browsing untrusted sites until the patch is applied

Patch Information

The vendor addressed CVE-2026-87860 in Subscriptions for WooCommerce version 2.0.3 by adding security token verification to the cancellation request handler. Site administrators should update through the WordPress plugin dashboard or via wp-cli plugin update subscriptions-for-woocommerce. See the WPScan Vulnerability Report for advisory details.

Workarounds

Deploy a web application firewall rule that blocks requests to the plugin's cancellation endpoint when the Referer header is absent or off-domain
Temporarily disable the plugin if patching cannot be scheduled and subscription volume is low
Require customers to confirm cancellations through an email verification flow implemented via a custom hook

bash

# Example WP-CLI update command
wp plugin update subscriptions-for-woocommerce --version=2.0.3