PT-2026-66894 · Wp Swings · Woocommerce Subscriptions
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the
save meta boxes() function persisting the wps plan user role membership plan meta from $ POST without an allowlist that excludes privileged roles — the only validations applied, sanitize key() and wp roles()->is role(), both accept 'administrator' as a valid value, and the UI's disabled attribute on the role dropdown is a client-side-only control trivially bypassed via DevTools or a direct POST request; additionally, because the wps membership plan custom post type is registered with capability type => 'post', any user who can edit posts satisfies the current user can('edit post', $post id) guard in save meta boxes(). This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their privileges to Administrator by storing 'administrator' as the role granted on membership acquisition, which the Pro companion plugin then applies via add role() during membership lifecycle events. Successful exploitation requires the Subscriptions for WooCommerce Pro companion plugin to be active, as it is the component that reads the stored wps plan user role meta via get post meta() and calls add role() to apply the role during membership lifecycle events.Fix
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Woocommerce Subscriptions