CVE-2026-18391: unknown woocommerce subscriptions
Vulnerability summary
CVE-2026-18391 is a critical (CVSS 9.8) vulnerability in unknown woocommerce subscriptions. EPSS estimates a 0.96% chance of exploitation in the next 30 days, higher than 61.2% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 12-08-2026PublishedVulnerability first disclosed.
- 12-08-2026Last modifiedVulnerability information updated.
Description
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
EPSS trend
Probability
0.96%
Chance of exploitation in the next 30 days
Percentile
61%
Versus all other CVEs
30-day change
+0.35 pp
From 0.61% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
- CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected systems
Unknown1 product
- woocommerce subscriptions≥ 4.7.0, < 9.1.0
Wordpress1 product
- woocommerce-subscriptions< 9.1.0
2 vendors · 2 products