CVE-2026-87860
Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF
MEDIUM 4.3EPSS 0.2%
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making.
- Affected
- Subscriptions for WooCommerce
- CVSS v3.1 CNA
- 4.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - EPSS
- 0.17% chance of exploitation in the next 30 days, 6th percentile
- Published
- 2026-09-16
- Updated
- 2026-09-17