MEDIUM
CVE-2026-87854
CVSS
5.3
Description
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and payment dates.
Weakness (CWE)
CWE-200
Information Exposure
EPSS Score
0.27%
Probability of exploitation in next 30 days
19.6th percentile
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.