WordPress security changelog
HIGH CVE-2026-15414 Received

Membership-plan role assignment lets Contributors become Administrators

Subscriptions for WooCommerce through 2.0.0 lets a Contributor-or-higher user edit the wps_membership_plan post type because it uses ordinary post capabilities. In save_meta_boxes(), the attacker can submit administrator as the _wps_plan_user_role POST value; sanitize_key() and wp_roles()->is_role() accept it, while the disabled role option in the browser is only a client-side restriction. The plugin stores that privileged role in membership-plan metadata, and the active Pro companion plugin later reads it and calls add_role() during a membership lifecycle event, elevating the attacker to Administrator. Exploitation therefore requires the Pro companion plugin and a membership acquisition event that applies the stored role.

CVE / CNA score 8.8 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Subscriptions for WooCommerce
Plugin slug
subscriptions-for-woocommerce
Affected
<= 2.0.0
Safe version
2.0.1
Published
Aug 01, 2026
Weakness
CWE-269 — Improper Privilege Management

This CVE was published Aug 01, 2026 and is one of 5 known issues for this plugin.

What to do

Update, patch or deactivate.

Update Subscriptions for WooCommerce to 2.0.1 or later. Review membership plans for privileged _wps_plan_user_role values, inspect Contributor and other low-privilege accounts for unexpected role changes, invalidate suspicious sessions, and investigate administrator activity if an unauthorized elevation occurred.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the `save_meta_boxes()` function persisting the `_wps_plan_user_role` membership plan meta from `$_POST` without an allowlist that excludes privileged roles — the only validations applied, `sanitize_key()` and `wp_roles()->is_role()`, both accept `'administrator'` as a valid value, and the UI's `disabled` attribute on the role dropdown is a client-side-only control trivially bypassed via DevTools or a direct POST request; additionally, because the `wps_membership_plan` custom post type is registered with `capability_type => 'post'`, any user who can edit posts satisfies the `current_user_can('edit_post', $post_id)` guard in `save_meta_boxes()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their privileges to Administrator by storing `'administrator'` as the role granted on membership acquisition, which the Pro companion plugin then applies via `add_role()` during membership lifecycle events. Successful exploitation requires the Subscriptions for WooCommerce Pro companion plugin to be active, as it is the component that reads the stored `_wps_plan_user_role` meta via `get_post_meta()` and calls `add_role()` to apply the role during membership lifecycle events.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources