What is GHSA-mp62-wj23-fc7f?

GHSA-mp62-wj23-fc7f is a security advisory published by GitHub Security Advisories with Medium severity. The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the...

Which CVE IDs does GHSA-mp62-wj23-fc7f cover?

GHSA-mp62-wj23-fc7f covers the following CVE IDs: CVE-2026-87854. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mp62-wj23-fc7f?

GHSA-mp62-wj23-fc7f has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-mp62-wj23-fc7fMediumCVSS 5.3

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the...

Vendor

GitHub Security Advisories

Published

September 16, 2026

Last Modified

September 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-87854 →

📋 Description

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and payment dates.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-87854
https://wpscan.com/vulnerability/a47ee557-3036-485a-91ad-af7b84209294
https://github.com/advisories/GHSA-mp62-wj23-fc7f