CVE-2026-15414: WooCommerce Subscriptions Plugin Privilege Escalation (CVSS 8.8)

Overview

A high-severity privilege escalation vulnerability has been disclosed in the Subscriptions for WooCommerce plugin for WordPress, tracked as CVE-2026-15414 with a CVSS score of 8.8 (High). The flaw allows authenticated users — even those with minimal subscriber-level access — to escalate their privileges to administrator level.

Vulnerability Details

Technical Description

The vulnerability exists in the save_meta_boxes() function within the plugin. This function persists the _wps_plan_user_role membership plan meta directly from the $_POST superglobal without implementing an allowlist that excludes privileged WordPress roles.

This means any authenticated user can craft a POST request that assigns themselves an elevated WordPress role — including administrator — by including the _wps_plan_user_role parameter set to a privileged value.

Root Cause

The core issue is a missing input validation control:

• The plugin reads _wps_plan_user_role from $_POST during a subscription update
• No capability check prevents low-privilege users from modifying this value
• No allowlist restricts which roles can be assigned via this parameter
• The role is persisted to the database and applied to the user account

Attack Scenario

1. Attacker registers a standard subscriber account on the WordPress site
2. Attacker crafts a POST request to update subscription metadata
3. The _wps_plan_user_role parameter is set to administrator
4. The plugin's save_meta_boxes() function persists the value without validation
5. Attacker's account is upgraded to administrator
6. Attacker gains full WordPress admin control

Affected Versions

All versions of the Subscriptions for WooCommerce plugin up to and including 2.0.0 are vulnerable.

Mitigation

Update immediately. Site administrators should:

1. Update the Subscriptions for WooCommerce plugin to a patched version (2.0.1 or later)
2. Audit existing user accounts for unexpected role elevations
3. Review WordPress user logs for accounts with recently changed roles
4. Temporarily restrict new subscriber registrations if the plugin cannot be immediately patched

Detection

Review your WordPress users table for unexpected administrator accounts:

SELECT user_login, user_registered, user_status 
FROM wp_users u
JOIN wp_usermeta m ON u.ID = m.user_id
WHERE m.meta_key = 'wp_capabilities' 
AND m.meta_value LIKE '%administrator%'
ORDER BY user_registered DESC;

Cross-reference this list against your known legitimate administrator accounts.

References

• NVD: CVE-2026-15414
• WooCommerce Security
• WordPress Plugins: Subscriptions for WooCommerce