This vulnerability (CVE-2026-56061) affects WP Swings Subscriptions for WooCommerce versions <= 1.9.5 and is categorized as CWE-862 Missing Authorization. It allows unauthenticated attackers to bypass access controls, potentially leading to unauthorized modification of subscription data or related integrity impacts. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No vendor advisory or patch is currently available, and no known exploits have been reported in the wild.

The vulnerability allows unauthenticated attackers to bypass authorization controls, leading to unauthorized modification of data within the affected plugin. This compromises data integrity but does not affect confidentiality or availability. The high CVSS score reflects the potential for significant unauthorized changes without requiring authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity related to subscription management. Avoid exposing the plugin to untrusted networks where possible.