CVE-2026-15397 is a missing authorization vulnerability (CWE-862) in the Subscriptions for WooCommerce WordPress plugin. The issue exists in all versions up to and including 2.0.0, where the wps_sfw_install_plugin_configuration AJAX handler does not properly verify user authorization. As a result, authenticated attackers with shop manager-level privileges or higher can install and activate arbitrary plugins from WordPress.org, potentially leading to full site compromise. The vulnerability is network exploitable with low attack complexity and requires high privileges but no user interaction. Confidentiality, integrity, and availability impacts are all rated high.

An attacker with shop manager-level access or higher can exploit this vulnerability to install and activate arbitrary WordPress plugins, which may lead to full site compromise including unauthorized code execution, data exposure, or denial of service. This elevates the risk posed by compromised or malicious shop manager accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict shop manager-level access to trusted users only and monitor for suspicious plugin installations. Avoid granting shop manager privileges to untrusted users. Follow updates from the vendor for a security patch or official fix.