The vulnerability identified as CVE-2026-24372 affects WP Swings Subscriptions for WooCommerce versions up to 1.8.10. It is an authentication bypass by spoofing vulnerability caused by input data manipulation. This allows an attacker to bypass authentication controls, potentially leading to unauthorized actions within the subscription management functionality. The CVSS 3.1 score of 7.5 reflects a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact is limited to integrity compromise without affecting confidentiality or availability. No patch or vendor advisory information is currently available, and no exploits have been observed in the wild.

Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms in the affected plugin, leading to unauthorized modification of subscription data or related integrity impacts. There is no indication of confidentiality or availability impact. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk profile. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or advisory is provided, users should monitor WP Swings communications for updates. Until a fix is available, consider restricting access to the plugin's administrative interfaces and applying compensating controls to limit potential abuse. Avoid exposing the affected plugin to untrusted networks where possible.