WordPress Plugin Vulnerabilities

WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection

Description

The plugin does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.

Proof of Concept

Affects Plugins

Plugin icon
woocommerce-subscriptions
Fixed in 7.9.1
Plugin icon
woocommerce-subscriptions
Fixed in 8.8.2
Plugin icon
woocommerce-subscriptions
Fixed in 9.1.0

References

CVE
CVE-2026-18391
URL
https://developer.woocommerce.com/2026/08/05/security-update-wc-subscriptions/

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Vasily Belolapotkov, Vlad Olaru
Verified
Yes
WPVDB ID
191f76cf-e5bd-4a37-ac1c-9187cea2aa27

Timeline

Publicly Published
2026-08-10 (about 2 days ago)
Added
2026-08-10 (about 1 day ago)
Last Updated
2026-08-11 (about 8 hours ago)

Other

Published
Title
Published
2022-02-08
Title
PHP Everywhere < 3.0.0 - Contributor+ RCE via Gutenberg Block
Published
2024-07-10
Title
WPCS < 1.2.0.4 - Unauthenticated Arbitrary Shortcode Execution
Published
2019-07-15
Title
Ad Inserter <= 2.4.21 - Authenticated Remote Code Execution
Published
2026-05-26
Title
WPCode < 2.3.6 - Author+ Remote Code Execution via XML-RPC wp.newPost
Published
2025-08-24
Title
WP Last Modified Info < 1.9.5 - Authenticated (Contributor+) Remote Code Execution