This vulnerability (CVE-2026-56061) affects WP Swings Subscriptions for WooCommerce versions up to 1.9.5. It is classified as CWE-862 (Missing Authorization), meaning that the plugin fails to properly enforce access control checks, allowing unauthenticated attackers to perform unauthorized actions. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No vendor advisory or patch information is available at this time, and no known exploits are reported in the wild.

The vulnerability allows unauthenticated attackers to bypass authorization controls, potentially leading to unauthorized modification of subscription data or related integrity violations within the WooCommerce subscription management. Confidentiality and availability are not impacted according to the CVSS vector. The integrity impact is high, meaning attackers could alter data or state in unauthorized ways.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor WP Swings advisories for updates. Until a patch is available, consider restricting access to the affected plugin or disabling it if feasible to reduce exposure.