CVE-2026-87856

MediumCVSS 5.3/10Last modified Nov 6, 2026

Description

The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on standard front-end page views, allowing unauthenticated users to read the full contents of restricted posts and pages through other routes that render the same content.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284

Affected software

VendorProductVersions
UnknownSubscriptions for WooCommerce>= 2.0.0, < 2.1.1

References

Timeline

Published
Nov 5, 2026
Last modified
Nov 6, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-878575.3Temporal Server does not bind a workflow-history pagination token to the namespace and workflow named in the request that presents it. GetWoCVE-2026-878587.2Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated calleCVE-2026-878595.3morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the doubleCVE-2026-87866.3A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of tCVE-2026-878604.3The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscriptioCVE-2026-878619.1When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated viaCVE-2026-878628.1Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parentCVE-2026-878638.1An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On CVE-2026-878648.1Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending exCVE-2026-878657.4When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatCVE-2026-878669.1When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLSCVE-2026-878696.1The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up
CVE-2026-87856: Medium severity, CVSS 5.3 | Vulnix