Improper Capability Verification in WordPress Plugin Installation

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) to install and activate arbitrary Subscriptions for WooCommerce WordPress plugin before 2.0.1, resulting in remote code execution.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability affects the Subscriptions for WooCommerce plugin versions before 2.0.1 and stems from insufficient capability checks during plugin installation via AJAX actions. Despite being nonce-protected, the plugin fails to verify that users have the appropriate permissions before allowing installation and activation of arbitrary plugins. Shop Manager role users—who should lack plugin management capabilities—can exploit this flaw to install and activate malicious or unauthorized plugins. This represents a critical privilege escalation vulnerability (CWE-269: Improper Access Control) affecting any WordPress site running the vulnerable plugin version, potentially compromising site integrity and security posture.

Casky's 224 mapped security skills leverage Claude's extended reasoning to detect the attack patterns underlying TA0004 (Privilege Escalation) techniques. Practitioners using Casky would identify this vulnerability through detection of: (1) nonce validation without capability verification—a common anti-pattern that Casky's skills flag as incomplete authorization controls; (2) AJAX action handlers accepting user-supplied plugin slugs without proper access checks; (3) privilege escalation indicators where lower-privileged roles (Shop Manager) gain access to admin-level plugin management functions. The platform's skill mapping would surface findings related to improper access control in plugin ecosystems, helping practitioners correlate this CVE with similar patterns in their WordPress deployments and prioritize remediation across their environment.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15215.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-15215

Casky has 224 skills that investigate the attack patterns behind CVE-2026-15215. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn