CVE-2026-18391: CWE-94 Improper Control of Generation of Code ('Code Injection') in WooCommerce Subscriptions
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.
AI Analysis
Technical Summary
The WooCommerce Subscriptions plugin versions before 9.1.0 do not properly validate user input prior to unserializing it when High-Performance Order Storage is enabled. This results in a PHP Object Injection vulnerability (CWE-94) that can be exploited by unauthenticated attackers to achieve Remote Code Execution through a gadget chain in the plugin's bundled dependencies.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to execute arbitrary code remotely on the affected system, potentially leading to full system compromise. This elevates the risk significantly for stores using the affected plugin versions with High-Performance Order Storage enabled.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling High-Performance Order Storage if feasible or restrict access to vulnerable endpoints to trusted users only.
CVE-2026-18391: CWE-94 Improper Control of Generation of Code ('Code Injection') in WooCommerce Subscriptions
Description
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.
CVSS v3.1
Score 9.8critical
Affected software
WooCommerce Subscriptions
pkg:composer/woocommerce/subscriptionsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WooCommerce Subscriptions plugin versions before 9.1.0 do not properly validate user input prior to unserializing it when High-Performance Order Storage is enabled. This results in a PHP Object Injection vulnerability (CWE-94) that can be exploited by unauthenticated attackers to achieve Remote Code Execution through a gadget chain in the plugin's bundled dependencies.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to execute arbitrary code remotely on the affected system, potentially leading to full system compromise. This elevates the risk significantly for stores using the affected plugin versions with High-Performance Order Storage enabled.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling High-Performance Order Storage if feasible or restrict access to vulnerable endpoints to trusted users only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-30T14:11:55.443Z
- State
- PUBLISHED
Threat ID: 6a7c0ea3bf8831d53914351d
Added to database: 08/12/2026, 06:11:47 UTC
Last enriched: 08/12/2026, 06:31:41 UTC
Last updated: 09/26/2026, 13:47:43 UTC
Views: 112
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.