Summary
CVE-2026-18391 is a critical PHP Object Injection vulnerability in the WooCommerce Subscriptions WordPress plugin that allows unauthenticated remote code execution. On stores with High-Performance Order Storage (HPOS) enabled, the plugin unserializes user-supplied input without validation, and a gadget chain present in the plugin’s bundled dependencies can be leveraged to achieve full remote code execution. The issue carries a CVSS v3.1 base score of 9.8 (Critical).
Technical details
- Root cause: The plugin passes attacker-controlled input to PHP’s
unserialize()without proper validation. - Trigger conditions: Exploitable on WooCommerce stores that have High-Performance Order Storage (HPOS) enabled.
- Attack vector: Network-based, no authentication or user interaction required (AV:N, PR:N, UI:N).
- Impact: Successful exploitation results in PHP Object Injection escalated via a gadget chain in bundled dependencies to full Remote Code Execution, giving an attacker complete control of the affected site (confidentiality, integrity, and availability all fully compromised).
Affected software
- WooCommerce Subscriptions versions prior to 7.9.1
- WooCommerce Subscriptions versions 7.9.1 and later, prior to 8.8.2
- WooCommerce Subscriptions versions 8.8.2 and later, prior to 9.1.0
Severity
- CVSS v3.1 Base Score: 9.8 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Update WooCommerce Subscriptions to version 9.1.0 or later (fixes are also available for the 7.x and 8.x branches — 7.9.1 and 8.8.2 respectively — for stores unable to jump to 9.1.0 directly).
- If patching is delayed: Disable High-Performance Order Storage (HPOS) where feasible, as the vulnerable code path requires it to be enabled; treat this as a temporary measure only, not a substitute for patching.
- Post-update: Review site and admin account activity, audit for unauthorized file changes, and rotate API keys/credentials if compromise is suspected, per vendor guidance.

