The Subscriptions for WooCommerce plugin prior to version 2.0.1 contains an authorization bypass vulnerability (CWE-639) where the plugin does not validate ownership of a subscription before rendering its details. An authenticated user can supply an arbitrary subscription ID and retrieve subscription information belonging to other customers. This flaw allows unauthorized disclosure of subscription data within the WooCommerce environment.

An attacker with an authenticated account on the affected WooCommerce site can access subscription details of other customers, including product information, subscription status, and subscription dates. This unauthorized data disclosure could lead to privacy violations and potential misuse of subscription information. There is no indication of privilege escalation or remote code execution from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 2.0.1, upgrading to version 2.0.1 or later is likely recommended once confirmed by the vendor. Until an official fix is available, restrict access to authenticated users and monitor for suspicious subscription access patterns.