{"id":"CVE-2026-87856","kind":"vulnerability","aliases":["CVE-2026-87856"],"related":[],"title":"WordPress Subscriptions for WooCommerce: restricted posts readable without logging in","description":"The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on standard front-end page views, allowing unauthenticated users to read the full contents of restricted posts and pages through other routes that render the same content.","summary":"The Subscriptions for WooCommerce WordPress plugin enforces membership content restrictions only on standard front-end page views. Other routes that render the same content skip the check, so an unauthenticated visitor can read the full text of restricted posts and pages.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","subscriptions-for-woocommerce","woocommerce","wordpress"],"not_affected_if":["no-membership-restrictions","plugin-2.1.1-or-later","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; affected versions are those before `2.1.1`.\n- Confirm whether restricted content is used on the site; the sources do not name the alternative routes.","fix":"- Subscriptions for WooCommerce: upgrade to `2.1.1` or later.","status":"open","published_at":"2026-11-05T06:17:09+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","triaged_at":"2026-11-05T06:33:04+00:00","updated_at":"2026-11-05T06:33:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T06:33:04Z","model":"claude-haiku-5-5","output":{"fix":"- Subscriptions for WooCommerce: upgrade to `2.1.1` or later.","reach":"internet","title":"WordPress Subscriptions for WooCommerce: restricted posts readable without logging in","impact":"medium","summary":"The Subscriptions for WooCommerce WordPress plugin enforces membership content restrictions only on standard front-end page views. Other routes that render the same content skip the check, so an unauthenticated visitor can read the full text of restricted posts and pages.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","subscriptions-for-woocommerce","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated visitors read full text of paywalled posts and pages","analyst_note":"Identify the alternative routes that render restricted content and confirm the fixed version from the plugin's changelog or the WordPress plugin page.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; affected versions are those before `2.1.1`.\n- Confirm whether restricted content is used on the site; the sources do not name the alternative routes.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-membership-restrictions","plugin-2.1.1-or-later"],"who_is_affected":"Sites running the Subscriptions for WooCommerce plugin before 2.1.1 that use it to restrict membership content. The sources do not name the alternative routes, so any site with restricted posts or pages should treat itself as exposed until updated. Sites without this plugin, or without membership restrictions, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4208,"output_tokens":623,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-87856':12A,15A '2.1.1':75C 'allow':89C 'check':53B 'content':34B,50B,80C,96C,109C 'cve':10A,13A 'end':41B,86C 'enforc':32B,77C 'front':40B,85C 'front-end':39B,84C 'full':61B,95C 'host':19B 'log':9A 'membership':33B,79C 'packag':16B 'page':42B,67B,87C,101C 'plugin':31B,73C 'post':6A,65B,99C 'read':59B,93C 'readabl':7A 'render':47B,106C 'restrict':5A,35B,64B,81C,98C 'rout':45B,104C 'self':18B 'self-host':17B 'skip':51B 'standard':38B,83C 'subscript':2A,21B,27B,69C 'subscriptions-for-woocommerc':20B 'text':62B 'unauthent':56B,90C 'user':91C 'view':43B,88C 'visitor':57B 'without':8A 'woocommerc':4A,23B,24B,29B,71C 'wordpress':1A,25B,30B,72C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Subscriptions for WooCommerce plugin before 2.1.1 that use it to restrict membership content. The sources do not name the alternative routes, so any site with restricted posts or pages should treat itself as exposed until updated. Sites without this plugin, or without membership restrictions, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","subscriptionsforwoocommerce","woocommerce","wordpress"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87856","severity":null,"published_at":"2026-11-05T06:17:09+00:00","modified_at":"2026-11-05T06:17:09+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","fetched_at":"2026-11-05T06:31:52+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}