CVE-2026-18391: WooCommerce Subscriptions RCE Vulnerability

CVE-2026-18391 Overview

CVE-2026-18391 affects the WooCommerce Subscriptions WordPress plugin in versions prior to 9.1.0. The plugin fails to validate user input before deserializing it on stores that have High-Performance Order Storage (HPOS) enabled. This flaw introduces a PHP Object Injection vulnerability [CWE-434] that unauthenticated attackers can escalate to Remote Code Execution (RCE) through a gadget chain present in the plugin's bundled dependencies.

Critical Impact
Unauthenticated remote attackers can execute arbitrary PHP code on affected WooCommerce stores, leading to full site compromise, data theft, and persistent backdoor installation.

Affected Products

WooCommerce Subscriptions WordPress plugin versions before 9.1.0
WordPress sites running WooCommerce with High-Performance Order Storage (HPOS) enabled
E-commerce stores using vulnerable bundled dependencies containing exploitable gadget chains

Discovery Timeline

2026-08-12 - CVE-2026-18391 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-18391

Vulnerability Analysis

The vulnerability originates in the WooCommerce Subscriptions plugin's handling of order data when HPOS is enabled. The plugin invokes PHP's unserialize() function on attacker-controlled input without prior validation or sanitization. This behavior is the classic precondition for PHP Object Injection.

When HPOS stores subscription-related order metadata, attacker-supplied serialized payloads reach the deserialization routine. PHP then instantiates arbitrary objects and invokes magic methods such as __wakeup() or __destruct() on them. Attackers chain these method calls through classes present in the plugin's bundled dependencies to reach dangerous sinks that execute arbitrary code.

Because the attack requires no authentication and no user interaction, any internet-exposed WooCommerce store running a vulnerable plugin version with HPOS enabled can be compromised remotely.

Root Cause

The root cause is unsafe deserialization of untrusted input. The plugin passes user-controlled data to unserialize() on the HPOS code path without input validation, type checking, or allow-listing of acceptable classes. Combined with exploitable gadget chains inside bundled third-party libraries, this transforms object injection into full remote code execution.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request containing a serialized PHP object payload to a vulnerable WooCommerce store with HPOS enabled. The plugin deserializes the payload during order processing. PHP invokes the magic methods on the reconstructed object graph, triggering a gadget chain that reaches a code execution sink such as system(), eval(), or file write primitives. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-18391

Indicators of Compromise

HTTP request bodies or query parameters containing serialized PHP object markers such as O: followed by class names and property counts
Unexpected PHP processes spawning shell commands from wp-content/plugins/woocommerce-subscriptions/ execution contexts
New or modified PHP files in the WordPress webroot, particularly webshells with names disguised as legitimate plugin files
Outbound network connections from the web server to unfamiliar hosts following order-related requests

Detection Strategies

Inspect web server access logs for POST or GET requests to WooCommerce order endpoints containing serialized PHP payload signatures
Monitor PHP error logs for unserialize() warnings referencing unknown or unexpected classes
Deploy web application firewall rules that block serialized PHP object patterns in requests to WooCommerce endpoints
Correlate unusual wp-admin or REST API traffic with subsequent process execution or file modification events on the host

Monitoring Recommendations

Enable file integrity monitoring on the WordPress installation directory to detect unauthorized file changes
Log and alert on PHP interpreter processes that spawn child processes such as sh, bash, curl, or wget
Track outbound connections from the web tier and alert on connections to non-approved destinations
Retain WordPress and web server logs centrally for retrospective hunting once new indicators become available

How to Mitigate CVE-2026-18391

Immediate Actions Required

Upgrade the WooCommerce Subscriptions plugin to version 9.1.0 or later on all affected WordPress sites
Audit stores with HPOS enabled for signs of compromise, including unexpected admin users, modified files, and scheduled tasks
Rotate WordPress administrator credentials, database credentials, and any API keys stored in the environment if compromise is suspected
Restrict administrative endpoints behind IP allow-lists or authentication proxies while patching is in progress

Patch Information

The vendor addressed CVE-2026-18391 in WooCommerce Subscriptions version 9.1.0. Site administrators should update through the WordPress plugin dashboard or by deploying the updated plugin package. Review the WPScan Vulnerability Report for vendor references and upgrade details.

Workarounds

Temporarily disable High-Performance Order Storage (HPOS) if immediate patching is not feasible, understanding that this may impact store functionality
Deploy a web application firewall rule to block requests containing serialized PHP object patterns targeting WooCommerce endpoints
Place the WordPress admin area behind additional authentication such as HTTP basic auth or a VPN until the plugin is upgraded

bash

# Upgrade WooCommerce Subscriptions using WP-CLI
wp plugin update woocommerce-subscriptions --version=9.1.0

# Verify installed version
wp plugin get woocommerce-subscriptions --field=version

# Optional: disable HPOS as a temporary mitigation
wp option update woocommerce_custom_orders_table_enabled no