The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 16 Sep 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making. | |
| Title | Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-09-16T06:00:16.817Z
Reserved: 2026-09-09T13:07:23.140Z
Link: CVE-2026-87860
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-16T06:16:35.333
Modified: 2026-09-16T06:16:35.333
Link: CVE-2026-87860
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.