CVE-2026-15414 is a privilege escalation vulnerability in the Subscriptions for WooCommerce plugin for WordPress, affecting versions up to 2.0.0. The vulnerability stems from the save_meta_boxes() function persisting the _wps_plan_user_role meta from user-supplied POST data without an allowlist that excludes privileged roles. The only validations applied accept 'administrator' as a valid role, and the client-side UI control preventing selection of this role can be bypassed trivially. Since the custom post type wps_membership_plan uses 'post' capability_type, any user who can edit posts can trigger the vulnerable code path. Authenticated attackers with Contributor-level access or higher can exploit this to assign themselves the Administrator role during membership lifecycle events, but only if the Subscriptions for WooCommerce Pro companion plugin is active, as it reads the stored meta and applies roles via add_role().

Successful exploitation allows an authenticated user with Contributor-level or higher privileges to escalate to Administrator privileges, gaining full control over the WordPress site. This can lead to complete compromise of the affected system, including data theft, site defacement, or further malicious actions. The vulnerability affects confidentiality, integrity, and availability of the site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level and higher access to trusted users only and consider disabling the Subscriptions for WooCommerce Pro companion plugin if not required. Monitor vendor channels for updates and apply patches promptly once available.