CVE-2026-18391 — WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading t…
Published: 2026-08-12 · CVSS: 9.8 · CVSS 3.1
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7