CVE-2026-18391: CWE-94 Improper Control of Generation of Code ('Code Injection') in WooCommerce Subscriptions
CVE-2026-18391 is a vulnerability in the WooCommerce Subscriptions WordPress plugin before version 9.1.0. It involves improper validation of user input before unserialization on stores with High-Performance Order Storage enabled. This flaw leads to a PHP Object Injection issue that allows unauthenticated users to escalate privileges to Remote Code Execution via a gadget chain in bundled dependencies.
AI Analysis
Technical Summary
The WooCommerce Subscriptions plugin versions before 9.1.0 do not properly validate user input prior to unserializing it when High-Performance Order Storage is enabled. This results in a PHP Object Injection vulnerability (CWE-94) that can be exploited by unauthenticated attackers to achieve Remote Code Execution through a gadget chain in the plugin's bundled dependencies.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to execute arbitrary code remotely on the affected system, potentially leading to full system compromise. This elevates the risk significantly for stores using the affected plugin versions with High-Performance Order Storage enabled.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling High-Performance Order Storage if feasible or restrict access to vulnerable endpoints to trusted users only.
CVE-2026-18391: CWE-94 Improper Control of Generation of Code ('Code Injection') in WooCommerce Subscriptions
Description
CVE-2026-18391 is a vulnerability in the WooCommerce Subscriptions WordPress plugin before version 9.1.0. It involves improper validation of user input before unserialization on stores with High-Performance Order Storage enabled. This flaw leads to a PHP Object Injection issue that allows unauthenticated users to escalate privileges to Remote Code Execution via a gadget chain in bundled dependencies.
Affected software
pkg:composer/woocommerce/subscriptionsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WooCommerce Subscriptions plugin versions before 9.1.0 do not properly validate user input prior to unserializing it when High-Performance Order Storage is enabled. This results in a PHP Object Injection vulnerability (CWE-94) that can be exploited by unauthenticated attackers to achieve Remote Code Execution through a gadget chain in the plugin's bundled dependencies.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to execute arbitrary code remotely on the affected system, potentially leading to full system compromise. This elevates the risk significantly for stores using the affected plugin versions with High-Performance Order Storage enabled.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling High-Performance Order Storage if feasible or restrict access to vulnerable endpoints to trusted users only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-30T14:11:55.443Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7c0ea3bf8831d53914351d
Added to database: 08/12/2026, 06:11:47 UTC
Last enriched: 08/12/2026, 06:31:41 UTC
Last updated: 08/12/2026, 08:56:13 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.