CVE-2026-18391

Deferred Deferred - Pending Action

PHP Object Injection in WooCommerce Subscriptions

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: WPScan

Description

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-18391

EUVD

EUVD-2026-57100

Affected Vendors & Products

Vendor	Product	Version / Range
woocommerce	subscriptions	to 9.1.0 (exc)
woocommerce	subscriptions	to 7.9.1 (exc)
woocommerce	subscriptions	to 8.8.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability is a PHP Object Injection flaw in the WooCommerce Subscriptions WordPress plugin before version 9.1.0. When High-Performance Order Storage is enabled, the plugin fails to validate user input before unserializing it. Attackers can exploit this to perform Remote Code Execution (RCE) by using a gadget chain from bundled dependencies.

Detection Guidance

Check the installed version of the WooCommerce Subscriptions plugin using WordPress admin panel or run the command: wp plugin list | grep 'woocommerce-subscriptions'. If the version is below 9.1.0, the system is vulnerable.

Impact Analysis

Unauthenticated attackers can exploit this to execute arbitrary code on your server, potentially taking full control of your WordPress site. This could lead to data theft, malware installation, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties and reputational damage if exploited.

Mitigation Strategies

Update the WooCommerce Subscriptions plugin to version 9.1.0 or later immediately. Disable High-Performance Order Storage if not required until the update is applied.

Hi! I’m here to help you understand CVE-2026-18391. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70