CVE-2026-1926: 
WordPress vulnerability analysis and mitigation

CVE-2026-1926 is a missing authorization vulnerability in the Subscriptions for WooCommerce plugin for WordPress that allows unauthenticated attackers to cancel any active WooCommerce subscription. The flaw affects all versions of the plugin up to and including 1.9.2, and was disclosed on March 18, 2026, with the assigning organization being Wordfence. It carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, EUVD).

The root cause is a missing capability check (CWE-862) on the wps_sfw_admin_cancel_susbcription() function, which is hooked to WordPress's init action without any authentication or authorization enforcement (Wordfence). The function only performs a non-empty check on the nonce parameter rather than properly validating it via wp_verify_nonce(), meaning any arbitrary nonce value will pass the check (WordPress Trac). An unauthenticated attacker can exploit this by sending a crafted HTTP GET request with an arbitrary nonce and a target subscription ID via the wps_subscription_id parameter, requiring no prior authentication or elevated privileges.

Successful exploitation allows any unauthenticated remote attacker to cancel any active WooCommerce subscription on the affected WordPress site, directly impacting the integrity of subscription data and causing financial and operational disruption to merchants and their customers (Wordfence). There is no confidentiality or availability impact (no data is exposed and the service itself is not taken down), but the integrity loss from mass subscription cancellations could result in significant revenue loss and customer churn for e-commerce operators. The attack requires no user interaction and can be executed at scale against all subscriptions on a vulnerable site.

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1926 as of the available data. The EPSS score is approximately 0.00102 (roughly 0.1%), indicating a low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity and lack of authentication requirements make it straightforward to exploit if targeted.

1. Reconnaissance: Identify WordPress sites running the Subscriptions for WooCommerce plugin (version ≤ 1.9.2) using tools like WPScan, Shodan, or by inspecting plugin directories at /wp-content/plugins/subscriptions-for-woocommerce/.
2. Enumerate subscription IDs: Attempt to enumerate valid WooCommerce subscription post IDs (typically sequential integers) by observing order confirmation emails, public-facing account pages, or through brute-force of the wps_subscription_id parameter.
3. Craft the malicious GET request: Construct a GET request to the target WordPress site's front-end URL with the required parameters. Since the nonce check only verifies non-emptiness, any arbitrary string suffices: GET /?wps_subscription_id=<TARGET_ID>&wps_sfw_nonce=arbitrary HTTP/1.1
4. Trigger the cancellation: Submit the crafted request. The init hook fires wps_sfw_admin_cancel_susbcription(), which processes the cancellation without verifying the caller's identity or the nonce's validity, resulting in the target subscription being cancelled (Wordfence, WordPress Trac).
5. Scale the attack: Repeat the request across a range of subscription IDs to cancel multiple or all active subscriptions on the site.

• Network: Unusual volume of HTTP GET requests to the WordPress front-end containing both wps_subscription_id and a nonce-like parameter (e.g., wps_sfw_nonce) from unauthenticated sources or unexpected IP addresses.
• Logs: WordPress/web server access logs showing repeated GET requests with wps_subscription_id=<integer> parameters from a single or rotating IP, especially without a valid session cookie.
• Application: Sudden mass cancellation of WooCommerce subscriptions visible in the WooCommerce admin dashboard, particularly if cancellations occur outside normal business hours or without corresponding customer-initiated actions.
• Database: Unexpected status changes in the wp_posts table for subscription post types (e.g., status changed to wc-cancelled) without corresponding admin or customer log entries.

The vendor (WP Swings) released a patched version of the plugin. Users should update the Subscriptions for WooCommerce plugin to version 1.9.3 or later, which implements proper capability checks and nonce validation (Wordfence, WordPress Trac Changeset). As a temporary workaround prior to patching, site administrators can use a Web Application Firewall (WAF) rule to block unauthenticated GET requests containing the wps_subscription_id parameter. Monitoring WooCommerce subscription status changes for anomalies is also recommended as a detective control.

The vulnerability was discovered and reported by Wordfence, which published the advisory through its threat intelligence platform (Wordfence). It was also catalogued by ENISA's European Vulnerability Database (EUVD) and referenced by Spanish national cybersecurity agencies INCIBE and CCN-CERT (INCIBE). No significant social media discussion or notable researcher commentary beyond standard vulnerability aggregation has been observed.