On August 7, 2026, three separate CVEs hit the Subscriptions for WooCommerce plugin by WP Swings, all targeting versions before 2.0.1. That's one plugin, three distinct vulnerability classes, disclosed on the same day. If you run WooCommerce subscriptions on any of your sites, this is the part where you check your plugin version.

CVE-2026-15214: Your customers can see each other's subscriptions

The most immediately concerning flaw is an insecure direct object reference — IDOR in security shorthand. The plugin renders subscription details when a logged-in customer supplies a subscription ID. The problem is that it never checks whether the requester actually owns that subscription. Any authenticated customer can enumerate subscription IDs and pull back another customer's subscribed product, subscription status, and billing dates.

This is not a theoretical risk. Subscription IDs in WooCommerce are sequential integers. A customer who creates an account and starts guessing numbers can map out every active subscription on the store. The data exposed includes what someone bought, when their next payment is due, and whether their subscription is active, on hold, or cancelled. That is enough to build a profile of purchasing behavior, and in some business models — think supplements, coaching programs, membership sites — the subscription itself is sensitive information.

The fix landed in version 2.0.1. If you are running anything earlier, update now.

CVE-2026-15414: Privilege escalation through the same plugin

The second CVE is an improper privilege management issue. Details are thinner on this one — the Rapid7 entry confirms it affects versions up to and including 2.0.0, but does not provide the full attack chain. What we know is that the flaw allows an authenticated user to escalate beyond their intended role. Combined with the IDOR above, that means a low-privilege account could potentially both read other customers' subscription data and act on it.

The practical risk depends on how your WooCommerce installation handles user roles. If you have stores where customers can register accounts freely — which is most WooCommerce stores — the attack surface is wide open.

CVE-2026-15211: PayPal payments can be manipulated

The third vulnerability is the one that should make store owners lose sleep. The plugin does not validate the payment amount or properly bind the PayPal payment to the original order. In plain terms, an attacker could potentially manipulate the payment amount during a PayPal checkout flow and have the order confirmed at a different price than intended.

This is not data leakage. This is direct revenue impact. A customer (or someone who has intercepted the checkout flow) could modify the payment request sent to PayPal, pay a reduced amount, and have the subscription activated at full price. For stores processing even modest subscription volumes, the cumulative financial exposure is significant.

Again, version 2.0.1 addresses this. But if you have already processed payments through the vulnerable versions, it is worth auditing recent PayPal transactions for discrepancies between the order total and the amount actually captured.

What to do right now

First, check whether you have the Subscriptions for WooCommerce plugin installed. It is a freemium plugin from WP Swings, not to be confused with the official WooCommerce Subscriptions extension by Woo. If you are running the official Woo Subscriptions, you are not affected by these CVEs.

If you do have the WP Swings plugin, check the version. Anything below 2.0.1 is vulnerable. Update immediately.

Second, audit your subscription data. If you have been running the vulnerable version, assume that subscription details were accessible to any logged-in customer. Depending on your privacy obligations — GDPR, CCPA, or just basic customer trust — you may need to disclose this to affected subscribers.

Third, check your PayPal transaction history. The payment validation flaw means some orders may have been confirmed at incorrect amounts. Reconcile your WooCommerce order totals against actual PayPal captures for the period you were running the vulnerable version.

The bigger pattern

Three CVEs in one plugin on one day is not unusual in the WordPress ecosystem, but it is a reminder of how much trust we place in third-party code. The WP Swings Subscriptions plugin has a significant install base, and all three vulnerabilities were present in the same version range. The IDOR alone represents a fundamental authorization failure — the kind of thing that should be caught in basic code review.

This is also the second WooCommerce-related security story in a week. WordPress 7.0.3 dropped on August 6 with 12 core security fixes, and WooCommerce 11.0 shipped on August 4 with its own set of changes. The ecosystem is moving fast, and the security surface is growing with it.

If you manage WordPress sites for clients, this is a good week to run a full plugin audit. Check every subscription, payment, and e-commerce plugin against the latest vulnerability databases. The cost of a proactive update is five minutes. The cost of a exploited payment validation flaw is harder to calculate.

Sources: WPScan — CVE-2026-15214, FreshySites Security Bulletin, Rapid7 — CVE-2026-15414, NVD — CVE-2026-15211