CVE-2023-35914 HIGH

CVE-2023-35914: WordPress WooCommerce Subscriptions Plugin <= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR)

Vendor Woocommerce

Product Woo Subscriptions

Weakness CWE-639 · IDOR

Published December 20, 2023

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo Subscriptions: from n/a through 5.1.2.

Explanation of Vulnerability in Simple Terms

02Summary

Woo Subscriptions versions up to 5.1.2 contain an authorization flaw that allows unauthenticated attackers to read sensitive subscription data over the network. The vulnerability requires no user interaction and exposes confidential information without modifying or disrupting service. Site administrators should update to a version newer than 5.1.2 immediately.

What an attacker can do

03Attacker Capabilities

Read sensitive subscription data without authentication.

Potential impact on your site

04Site Impact

Customer subscription details and related sensitive data are exposed to anyone on the internet.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

December 20, 2023 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-35914 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html AskarLabs — CWE-639 write-up Authorization Bypass Through User-Controlled Key

Related vulnerabilities