Description

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) to install and activate arbitrary Subscriptions for WooCommerce WordPress plugin before 2.0.1, resulting in remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-07T06:16:55.227Z",
  "pubdate": "2026-08-07T06:16:55.227Z",
  "executiveSummary": "A privilege escalation and remote code execution vulnerability exists in the Subscriptions for WooCommerce WordPress plugin before 2.0.1. The flaw resides in a nonce-protected AJAX action designed for plugin management.\nThe vulnerability allows authenticated users assigned to the Shop Manager role, who inherently lack the necessary administrative capabilities required to manage the Subscriptions for WooCommerce WordPress plugin before 2.0.1, to arbitrarily install and activate plugins via user-supplied slugs.\nSuccessful exploitation of this security deficiency culminates in remote code execution on the underlying hosting server. The risk implication is severe, as it enables unauthorized administrative-level actions and potential total system compromise by low-privileged internal actors.\nExploitation requires authenticated access with specific low-level privileges (Shop Manager role), knowledge of the valid AJAX nonce, and the ability to supply malicious plugin slugs pointing to arbitrary code payloads.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient access control enforcement and missing capability checks within the plugin's AJAX request handling logic. Specifically, the vulnerable component processes requests to install and activate plugins from user-supplied slugs without verifying whether the requesting user possesses adequate administrative privileges.\nWhile the AJAX endpoint is protected by a cryptographic nonce to prevent Cross-Site Request Forgery, it fails to perform a secondary capability check using functions such as current_user_can() to ensure the session initiating the request is authorized to perform plugin installations.\nThe affected product is the Subscriptions for WooCommerce WordPress plugin, specifically all versions prior to 2.0.1. The attack vector is exposed via network requests directed at the WordPress AJAX processing interface.\nThe attack flow proceeds in a sequential manner. First, an authenticated attacker possessing the Shop Manager role obtains the necessary AJAX nonce, which may be exposed within the dashboard interface for authorized tasks. Second, the attacker constructs a crafted HTTP POST request targeting the vulnerable AJAX action, supplying a malicious plugin slug. This slug can reference an arbitrary plugin package, potentially hosted externally or crafted to contain malicious execution vectors.\nUpon receiving the request, the backend handler validates the nonce but bypasses robust authorization checks due to the flawed capability validation logic. Consequently, the application proceeds to download, extract, and activate the user-supplied plugin slug.\nPost-exploitation impact is critical. By installing and activating an arbitrary plugin containing malicious PHP code, the attacker achieves remote code execution within the context of the web server user. This permits full control over the WordPress installation, database manipulation, and potential lateral movement across the hosting infrastructure."
}