---
id: "CVE-2026-87856"
kind: "vulnerability"
aliases: ["CVE-2026-87856"]
title: "WordPress Subscriptions for WooCommerce: restricted posts readable without logging in"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "subscriptions-for-woocommerce", "woocommerce", "wordpress"]
not_affected_if: ["no-membership-restrictions", "plugin-2.1.1-or-later", "plugin-not-installed"]
published_at: "2026-11-05T06:17:09+00:00"
first_seen_at: "2026-11-05T06:31:52+00:00"
updated_at: "2026-11-05T06:33:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87856", "first_seen_at": "2026-11-05T06:31:52+00:00"}]
exploit_sources: []
---

# WordPress Subscriptions for WooCommerce: restricted posts readable without logging in

The Subscriptions for WooCommerce WordPress plugin enforces membership content restrictions only on standard front-end page views. Other routes that render the same content skip the check, so an unauthenticated visitor can read the full text of restricted posts and pages.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins; affected versions are those before `2.1.1`.
- Confirm whether restricted content is used on the site; the sources do not name the alternative routes.

## Fix

- Subscriptions for WooCommerce: upgrade to `2.1.1` or later.

## Timeline

- 2026-11-05T06:31:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87856

## From the sources

The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on standard front-end page views, allowing unauthenticated users to read the full contents of restricted posts and pages through other routes that render the same content.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_