Loading vulnerability…
CVE-2026-15414 is a privilege escalation vulnerability affecting the Subscriptions for WooCommerce plugin for WordPress in versions up to and including 2.0.0. The flaw is caused by the save_meta_boxes() function persisting membership plan role metadata from $_POST without enforcing a server-side allowlist to prevent assignment of privileged roles. The implemented checks only sanitize the supplied value and verify that it is a valid WordPress role, which still permits privileged roles such as administrator. The vulnerable workflow also relies on a client-side-only UI restriction on the role selection field, which can be bypassed by modifying requests directly. Because the wps_membership_plan custom post type uses standard post capabilities, users able to edit posts can satisfy the authorization check protecting the metadata save path. When the Subscriptions for WooCommerce Pro companion plugin is active, it later reads the stored membership role metadata and applies the configured role during membership lifecycle events, enabling unauthorized elevation to Administrator.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a standalone Python exploit framework centered on WordPress targeting. It contains one substantive code file, wp2exp_2026.py, plus a README, license, and gitignore. The script is presented as an all-in-one tool that combines reconnaissance, vulnerability detection, exploitation, and post-exploitation actions against WordPress core and several plugins. Repository structure is minimal: README.md documents usage and claimed capabilities; wp2exp_2026.py is the operational entry point; there are no external modules besides Python standard library and optional SOCKS proxy support. The script supports single-target and multi-target execution, JSON reporting, threaded scanning, proxying, and multiple modes (scan, exploit, shell). Core capabilities described and partially evidenced in code/constants include: WordPress version fingerprinting; WAF detection from headers/body markers; XML-RPC probing; user enumeration through REST and author archives; plugin version enumeration; safe probing of the WordPress batch REST endpoint; CVE-specific checks for WordPress core and multiple plugins; exploitation chains for pre-auth admin creation; SQLi-based information extraction; content disclosure/dumping; and optional webshell deployment/verification. The code includes constants for vulnerable WordPress core ranges, plugin CVE metadata, SQLi/XPATH extraction regexes, union-based injection parameters, and a main workflow that runs scan_target() followed by exploit_chain() when exploit or shell mode is selected. Fingerprintable endpoints are primarily WordPress web paths and REST routes: /feed/, /readme.html, /wp-json/wp/v2/users, ?rest_route=, ?author=N, and /wp-json/batch/v1. The README also references POST /wp/v2/users as part of an admin-creation chain and system.listMethods for XML-RPC probing. A plugin namespace constant mcp/v1 appears in code for AI Engine targeting. The tool also supports a local SOCKS5/TOR proxy at socks5h://127.0.0.1:9050. Overall, this is not merely a detector script. It is an exploit-oriented framework with scanning and exploitation stages, optional shell deployment, and machine-readable reporting. Given the breadth of supported targets, chaining logic, and shell mode, its maturity is best characterized as weaponized.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.