CVE-2026-15215: CWE-269 Improper Privilege Management in Subscriptions for WooCommerce
A privilege management vulnerability exists in the Subscriptions for WooCommerce WordPress plugin before version 2.0.1. The plugin fails to verify user capabilities properly before allowing installation and activation of plugins via a nonce-protected AJAX action. This flaw permits users with the Shop Manager role, who normally lack plugin management permissions, to install and activate arbitrary plugins, potentially leading to remote code execution.
AI Analysis
Technical Summary
CVE-2026-15215 is an improper privilege management vulnerability (CWE-269) in the Subscriptions for WooCommerce WordPress plugin versions prior to 2.0.1. The plugin does not correctly verify the user's capability before processing a user-supplied slug to install and activate plugins through a nonce-protected AJAX action. This allows users assigned the Shop Manager role, which lacks plugin management capabilities, to install and activate arbitrary plugins, resulting in the possibility of remote code execution.
Potential Impact
An attacker with Shop Manager privileges can exploit this vulnerability to install and activate arbitrary plugins, which may lead to full remote code execution on the affected WordPress site. This compromises confidentiality, integrity, and availability of the system.
Mitigation Recommendations
No official patch or remediation guidance is currently confirmed. Users should monitor the vendor advisory for updates and apply the official fix once available. Until then, restrict Shop Manager role permissions or disable AJAX plugin installation actions if possible.
CVE-2026-15215: CWE-269 Improper Privilege Management in Subscriptions for WooCommerce
Description
A privilege management vulnerability exists in the Subscriptions for WooCommerce WordPress plugin before version 2.0.1. The plugin fails to verify user capabilities properly before allowing installation and activation of plugins via a nonce-protected AJAX action. This flaw permits users with the Shop Manager role, who normally lack plugin management permissions, to install and activate arbitrary plugins, potentially leading to remote code execution.
CVSS v3.1
Score 8.8high
Affected software
Subscriptions for WooCommerce
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-15215 is an improper privilege management vulnerability (CWE-269) in the Subscriptions for WooCommerce WordPress plugin versions prior to 2.0.1. The plugin does not correctly verify the user's capability before processing a user-supplied slug to install and activate plugins through a nonce-protected AJAX action. This allows users assigned the Shop Manager role, which lacks plugin management capabilities, to install and activate arbitrary plugins, resulting in the possibility of remote code execution.
Potential Impact
An attacker with Shop Manager privileges can exploit this vulnerability to install and activate arbitrary plugins, which may lead to full remote code execution on the affected WordPress site. This compromises confidentiality, integrity, and availability of the system.
Mitigation Recommendations
No official patch or remediation guidance is currently confirmed. Users should monitor the vendor advisory for updates and apply the official fix once available. Until then, restrict Shop Manager role permissions or disable AJAX plugin installation actions if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-09T08:04:31.124Z
- State
- PUBLISHED
Threat ID: 6a75772fbf8831d539df5e55
Added to database: 08/07/2026, 06:11:59 UTC
Last enriched: 08/14/2026, 15:55:50 UTC
Last updated: 09/21/2026, 22:01:32 UTC
Views: 60
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.