WooCommerce Subscriptions <9.1.0 Unauthenticated RCE via PHP Object Injection (CVE-2026-18391)

Vulnerability Overview Vulnerability Name: WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection Description: In stores where high-performance order storage is not enabled, the plugin directly deserializes user input without validation, allowing unauthenticated attackers to achieve Remote Code Execution (RCE) through a gadget chain. CVE ID: CVE-2026-18391 CVSS Score: 9.8 (critical) Type: RCE OWASP Top 10: A1: Injection CWE: CWE-94 Affected Range Affected Plugin: - woocommerce-subscriptions (Fixed Versions: 7.9.1, 8.8.2, 9.1.0) Remediation Fixed Versions: 7.9.1, 8.8.2, 9.1.0 Timeline Public Disclosure Date: 2026-08-10 Added Date: 2026-08-10 Last Updated Date: 2026-08-11 Additional Information Original Researchers: Vasily Belolapotkov, Vlad Olaru Verification Status: Yes WPVDB ID: 191f76cf-e5bd-4a37-ac1c-9187cea2aa27 Reference Links Official Security Update Page Other Related Vulnerabilities 2025-05-07: Walmart 2024-11-25: InPost Gallery < 2.1.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via inpost_gallery_get_shortcode_template 2014-08-01: UnGallery - Arbitrary Command Execution 2018-12-10: WooCommerce <= 3.4.5 - Authenticated Phar Deserialization 2024-10-27: All-in-One WP Migration and Backup < 7.87 - Authenticated (Administrator+) Arbitrary PHP Code Injection POC Code POC Code: No specific POC code is provided in the page; however, it mentions that the POC will be demonstrated on 2026-10-30, allowing users time to update.

Goal Reached Thanks to every supporter — we hit 100%!

WooCommerce Subscriptions <9.1.0 Unauthenticated RCE via PHP Object Injection (CVE-2026-18391)

More from this source