139 lines
6.7 KiB
JSON
139 lines
6.7 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-15414",
|
|
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Wordfence",
|
|
"dateReserved": "2026-07-10T14:30:07.093Z",
|
|
"datePublished": "2026-08-01T01:29:56.164Z",
|
|
"dateUpdated": "2026-08-03T19:08:41.988Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
|
|
"shortName": "Wordfence",
|
|
"dateUpdated": "2026-08-01T01:29:56.164Z"
|
|
},
|
|
"affected": [
|
|
{
|
|
"vendor": "wpswings",
|
|
"product": "Subscriptions for WooCommerce",
|
|
"versions": [
|
|
{
|
|
"version": "0",
|
|
"status": "affected",
|
|
"lessThanOrEqual": "2.0.0",
|
|
"versionType": "semver"
|
|
}
|
|
],
|
|
"defaultStatus": "unaffected"
|
|
}
|
|
],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the `save_meta_boxes()` function persisting the `_wps_plan_user_role` membership plan meta from `$_POST` without an allowlist that excludes privileged roles — the only validations applied, `sanitize_key()` and `wp_roles()->is_role()`, both accept `'administrator'` as a valid value, and the UI's `disabled` attribute on the role dropdown is a client-side-only control trivially bypassed via DevTools or a direct POST request; additionally, because the `wps_membership_plan` custom post type is registered with `capability_type => 'post'`, any user who can edit posts satisfies the `current_user_can('edit_post', $post_id)` guard in `save_meta_boxes()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their privileges to Administrator by storing `'administrator'` as the role granted on membership acquisition, which the Pro companion plugin then applies via `add_role()` during membership lifecycle events. Successful exploitation requires the Subscriptions for WooCommerce Pro companion plugin to be active, as it is the component that reads the stored `_wps_plan_user_role` meta via `get_post_meta()` and calls `add_role()` to apply the role during membership lifecycle events."
|
|
}
|
|
],
|
|
"title": "Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta",
|
|
"references": [
|
|
{
|
|
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/195f86a5-e3dc-4414-bbe3-dea312bf30a9?source=cve"
|
|
},
|
|
{
|
|
"url": "https://plugins.trac.wordpress.org/browser/subscriptions-for-woocommerce/tags/2.0.0/includes/membership/class-wps-membership-plan-cpt.php#L483"
|
|
},
|
|
{
|
|
"url": "https://plugins.trac.wordpress.org/browser/subscriptions-for-woocommerce/tags/2.0.0/includes/membership/class-wps-membership-plan-cpt.php#L477"
|
|
},
|
|
{
|
|
"url": "https://plugins.trac.wordpress.org/browser/subscriptions-for-woocommerce/tags/2.0.0/includes/membership/class-wps-membership-plan-cpt.php#L275"
|
|
},
|
|
{
|
|
"url": "https://plugins.trac.wordpress.org/browser/subscriptions-for-woocommerce/tags/2.0.0/admin/partials/membership/meta-box-plan-details.php#L102"
|
|
},
|
|
{
|
|
"url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3624543%40subscriptions-for-woocommerce&new=3624543%40subscriptions-for-woocommerce"
|
|
}
|
|
],
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"description": "CWE-269 Improper Privilege Management",
|
|
"cweId": "CWE-269",
|
|
"type": "CWE"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 8.8,
|
|
"baseSeverity": "HIGH"
|
|
}
|
|
}
|
|
],
|
|
"credits": [
|
|
{
|
|
"lang": "en",
|
|
"type": "finder",
|
|
"value": "Wordfence PRISM"
|
|
}
|
|
],
|
|
"timeline": [
|
|
{
|
|
"time": "2026-07-10T14:45:18.000Z",
|
|
"lang": "en",
|
|
"value": "Vendor Notified"
|
|
},
|
|
{
|
|
"time": "2026-07-31T12:27:03.000Z",
|
|
"lang": "en",
|
|
"value": "Disclosed"
|
|
}
|
|
]
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2026-08-03T19:08:20.758821Z",
|
|
"id": "CVE-2026-15414",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-08-03T19:08:41.988Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |