← CVE Intelligence

CVE-2026-18391

WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection PUBLISHED

Description (CNA)

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.

Affected (CNA)

Vendor / productVersions
Unknown / WooCommerce Subscriptionsaffected 4.7.0 before 9.1.0

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.