CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

CVE-2026-15414

highCVSS 8.8covered by 1 sourcefirst seen 2026-08-01
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the save_meta_boxes() function persisting the _wps_plan_user_role membership plan meta from $_POST without an allowlist that excludes privileged roles — the only validations applied, sanitize_key() and wp_roles()->is_role(), both accept 'administrator' as a valid value, and the UI's disabled attribute on the role dropdown is a client-side-only control trivially bypassed via DevTools or a direct POST request; additionally, because the wps_membership_plan custom post type is registered with capability_type => 'post', any user who can edit posts satisfies the current_user_can('edit_post', $post_id) guard in save_meta_boxes(). This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their privileges to Administrator by storing 'administrator' as the role granted on membership acquisition, which the Pro companion plugin then applies via add_role() during membership lifecycle events. Successful exploitation requires the Subscriptions for WooCommerce Pro companion plugin to be active, as it is the component that reads the stored _wps_plan_user_role meta via get_post_meta() and calls add_role() to apply the role during membership lifecycle events.

⚡ Watch CVE-2026-15414

Get an email if CVE-2026-15414 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

External references

NVD record for CVE-2026-15414

CVE.org record

Embed the live status

CVE-2026-15414 live status badge — this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-15414 status](https://www.csirts.com/badge/CVE-2026-15414)](https://www.csirts.com/cve/CVE-2026-15414)