Authorization Bypass in Subscriptions for WooCommerce Plugin

The Subscriptions for WooCommerce plugin for WordPress is affected by a missing authorization vulnerability (CVE-2026-15397) in all versions up to and including 2.0.0. The vulnerability resides within the wps_sfw_install_plugin_configuration AJAX handler, which fails to verify the authorization level of the user initiating the request. An attacker with authenticated access at the shop manager level or higher can exploit this handler to force the WordPress environment to install and activate arbitrary plugins from the WordPress.org repository. This capability enables attackers to install malicious plugins, resulting in full remote code execution and complete site compromise. Defenders should prioritize updating the plugin to a patched version once available or restricting access to the identified AJAX endpoint.

Attack Chain

1. The attacker authenticates as a user with shop manager or higher privileges on a WordPress site running the vulnerable plugin.
2. The attacker identifies the wps_sfw_install_plugin_configuration AJAX handler endpoint as the target.
3. The attacker crafts a request to the WordPress admin-ajax.php interface, invoking the vulnerable action.
4. The request includes parameters specifying the target plugin to be fetched from the WordPress.org repository.
5. The plugin fails to perform a capability check on the current user before processing the installation request.
6. The WordPress site automatically downloads and installs the specified plugin from the WordPress repository.
7. The plugin is activated on the site, granting the attacker the functionality provided by the newly installed plugin.
8. The attacker leverages the installed plugin to execute arbitrary code, escalate privileges, or exfiltrate data from the server.

Impact

Successful exploitation allows for the installation and activation of any plugin from the WordPress.org repository. In a production e-commerce environment, this leads to full site control, administrative access, customer data exfiltration, or the potential deployment of ransomware or backdoors. The vulnerability affects all users running Subscriptions for WooCommerce 2.0.0 or earlier.

Recommendation

• Update the "Subscriptions for WooCommerce" plugin to the latest available version provided by wpswings to resolve the authorization flaw.
• Inspect site plugin directories for recently installed or unknown plugins that do not align with known approved deployments.
• Audit user accounts with "Shop Manager" privileges and remove any unauthorized or unnecessary access.
• Deploy the Sigma rule below to monitor for suspicious AJAX requests directed toward the plugin's configuration handlers.