CVE-2026-15414
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the save_meta_boxes() function persisting the _wps_plan_user_role membership plan meta from $_POST without an allowlist that excludes privileged roles — the only validations applied, sanitize_key() and wp_roles()->is_role(), both accept 'administrator' as a valid value, and the UI's disabled attribute on the role dropdown is a client-side-only control trivially bypassed via DevTools or a direct POST request; additionally, because the wps_membership_plan custom post type is registered with capability_type => 'post', any user who can edit posts satisfies the current_user_can('edit_post', $post_id) guard in save_meta_boxes(). This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their privileges to Administrator by storing 'administrator' as the role granted on membership acquisition, which the Pro companion plugin then applies via add_role() during membership lifecycle events. Successful exploitation requires the Subscriptions for WooCommerce Pro companion plugin to be active, as it is the component that reads the stored _wps_plan_user_role meta via get_post_meta() and calls add_role() to apply the role during membership lifecycle events.
⚡ Watch CVE-2026-15414
Get an email if CVE-2026-15414 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-15414)