CVE-2026-87860 — Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logge…
Published: 2026-09-16 · CVSS: 4.3 · CVSS 3.1
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7