CVE-2026-87856

Full vulnerability record from the local CVENow database.

Description

The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on standard front-end page views, allowing unauthenticated users to read the full contents of restricted posts and pages through other routes that render the same content.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-11-05 06:17:09.367000

Last modified

2026-11-05 06:17:09.503000

View original CVE JSON

{
  "id": "CVE-2026-87856",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-05T06:17:09.367",
  "lastModified": "2026-11-05T06:17:09.503",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on standard front-end page views, allowing unauthenticated users to read the full contents of restricted posts and pages through other routes that render the same content."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Subscriptions for WooCommerce",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "2.0.0",
              "lessThan": "2.1.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/cbb00245-1e9b-4311-a4d0-ae80488e82d0/",
      "source": "[email protected]"
    }
  ]
}