WooCommerce Subscription

WooCommerce Subscription has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2026; all 6 are fixed as of September 2026. Their average CVSS score is 5.8, and the most serious one scores 8.3 out of 10. Severity breakdown: 0 critical and 1 high. 2023 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 2 of the records (33%). Other recurring categories include Authorization Bypass Through User-Controlled Key, Cross-Site Scripting.

Every one of the 6 issues recorded for WooCommerce Subscription has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, most of them (2) reported by Rafie Muhammad.

Strategic Overview

Avg CVSSMedium

5.8/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WooCommerce Subscription vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.3

WooCommerce Subscriptions <= 3.0.2 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

6 records


2026-08-14 00:00	WooCommerce Subscription < 9.1.0 - Unauthenticated PHP Object Injection WooCommerce Subscription < 9.1.0	`CVE-2026-18391`	5.3 Medium	Vasily Belolapotkov, Vlad Olaru	Yes
2024-01-17 00:00	WooCommerce Subscriptions < 5.8.0 - Missing Authorization WooCommerce Subscription < 5.8.0	`CVE-2023-50850`	4.3 Medium	Rafie Muhammad	Yes
2023-09-11 00:00	WooCommerce Subscription < 4.6.0 - Cross-Site Request Forgery WooCommerce Subscription < 4.6.0	`N/A`	4.3 Medium	foobar7	Yes
2023-06-19 00:00	WooCommerce Subscriptions <= 5.1.2 - Missing Authorization to Insecure Direct Object Reference WooCommerce Subscription <= 5.1.2	`CVE-2023-35914`	6.5 Medium	Rafie Muhammad	Yes
2020-04-02 00:00	WooCommerce Subscriptions <= 3.0.2 - Cross-Site Request Forgery WooCommerce Subscription < 3.0.3	`N/A`	8.3 High	Dewhurst Security	Yes
2019-03-11 00:00	WooCommerce Subscriptions < 2.6.3 - Stored Cross-Site Scripting WooCommerce Subscription < 2.6.3	`CVE-2019-18834`	6.1 Medium	Anonymous	Yes

Showing 1–6 of 6 reports