CVE-2026-18391: Unknown Woocommerce Subscriptions

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.

Affected products

• Unknown Woocommerce Subscriptions: from 4.7.0, before 9.1.0 (fixed in 9.1.0)

Published 2026-08-12. Last modified 2026-08-26.