CVE-2026-1926

Subscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `wps_sfw_admin_cancel_susbcription()` function in all versions up to, and including, 1.9.2. This is due to the function being hooked to the `init` action without any authentication or authorization checks, and only performing a non-empty check on the nonce parameter without actually validating it via `wp_verify_nonce()`. This makes it possible for unauthenticated attackers to cancel any active WooCommerce subscription by sending a crafted GET request with an arbitrary nonce value via the `wps_subscription_id` parameter.

We have discovered 847 live websites that are affected by CVE-2026-1926.

Run a Free Instant Scan



Affected Software

Product  Subscriptions For Woocommerce
Category Wordpress Plugins
Vulnerable Domains847 live websites (69% of Subscriptions For Woocommerce install base)
Vulnerable Versions
  • from 0 through 1.9.2
Vulnerable Versions Count45 versions ( 98% of all versions)


Common Weakness Enumeration

CWE-862 Missing Authorization



Details

  • Published - Mar 18, 2026
  • Updated - Apr 8, 2026

Credits

  • shrikant bhosale (finder)

Website Distribution by Country

Number of websites using CVE-2026-1926
United States365 websites


GB89 websites
Germany48 websites
Cyprus35 websites
France33 websites
South Africa21 websites
Canada21 websites
Australia18 websites
Spain18 websites
Netherlands17 websites

Website Distribution by TLD

Number of websites using CVE-2026-1926
.com446 websites
.org72 websites
.co.uk51 websites
.net22 websites
.com.au18 websites
.nl15 websites
.de13 websites
.com.br13 websites
.ca12 websites
.fr10 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-1926

Top websites that are affected by CVE-2026-1926. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
**************.com United States***,***
********.net GB***,***
******.org United States***,***
********************.com United States***,***
**************.com United States***,***
****************.com United States***,***
**************.com United States***,***
************.co United States***,***
******************.com GB***,***
**********.com United States*,***,***
See full domain list

FAQ

CVE-2026-1926 is Missing Authorization in Subscriptions For Woocommerce
A total of 847 websites have been identified as vulnerable to CVE-2026-1926, based on global website indexing conducted by WebTechSurvey.
The Subscriptions For Woocommerce is affected by the CVE-2026-1926 vulnerability.
Subscriptions For Woocommerce versions up to and including 1.9.2 are vulnerable to CVE-2026-1926.

References