critical9.8
CVE-2026-18391
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage …
Impact
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.
Affected products
| Product | Affected versions |
|---|---|
| WooCommerce Subscriptions WordPress Plugin | before 9.1.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.