CVE-2026-73364: Flexible Subscriptions PHP Vulnerability

CVE-2026-73364 Overview

CVE-2026-73364 is a PHP Object Injection vulnerability affecting the Flexible Subscriptions WordPress plugin in versions up to and including 1.8.1. The flaw stems from insecure deserialization of untrusted input [CWE-502], allowing unauthenticated attackers to inject crafted PHP objects into the application. When combined with a suitable gadget chain present in the WordPress core or other installed plugins, the vulnerability can lead to remote code execution, file operations, or complete site compromise. The issue was published to the National Vulnerability Database (NVD) with a network attack vector and no privileges or user interaction required.

Critical Impact
Unauthenticated attackers can trigger PHP object deserialization on affected WordPress sites, potentially leading to arbitrary code execution and full site takeover.

Affected Products

Flexible Subscriptions WordPress plugin versions <= 1.8.1
WordPress sites with the plugin installed and active
Hosting environments running vulnerable plugin instances

Discovery Timeline

2026-08-19 - CVE-2026-73364 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73364

Vulnerability Analysis

The vulnerability is classified as Deserialization of Untrusted Data [CWE-502]. Attackers supply attacker-controlled serialized PHP data to a plugin entry point that invokes unserialize() without sufficient validation. Once deserialized, PHP instantiates objects and triggers magic methods such as __wakeup() and __destruct(). If a suitable gadget chain exists in loaded code, this behavior can be pivoted into file writes, SQL execution, or command execution. The vulnerability requires no authentication and no user interaction, and can be exploited remotely over the network.

Root Cause

The root cause is the plugin's handling of serialized input from an attacker-reachable source. The plugin passes this data to PHP's native deserialization routine without integrity checks, allowlisting of classes, or use of safer alternatives such as JSON. Any object reachable at runtime becomes a potential gadget for exploitation.

Attack Vector

Exploitation occurs over the network against the WordPress HTTP interface exposed by the plugin. An attacker crafts a serialized PHP payload referencing classes available in the target environment and submits it to the vulnerable endpoint. Full technical details are available in the Patchstack Plugin Vulnerability Report.

// No verified exploit code available.
// See the Patchstack advisory for technical analysis.

Detection Methods for CVE-2026-73364

Indicators of Compromise

HTTP requests containing serialized PHP markers such as O:, a:, or s: in parameters processed by the Flexible Subscriptions plugin
Unexpected PHP files created in the wp-content/uploads/ or plugin directories
New or modified administrator accounts and unexpected scheduled tasks in wp-cron
Outbound connections from the web server to unknown hosts following suspicious POST requests

Detection Strategies

Inspect web server access logs for POST requests targeting Flexible Subscriptions endpoints with serialized object patterns
Correlate PHP error logs for __wakeup, __destruct, or class-not-found messages tied to plugin routes
Run WordPress integrity scans to identify unauthorized plugin, theme, or core file modifications

Monitoring Recommendations

Enable a web application firewall (WAF) ruleset that flags PHP serialized payloads in request bodies and query strings
Monitor filesystem changes under the WordPress installation directory and alert on new PHP files
Track the plugin version inventory across managed WordPress sites and alert when versions <= 1.8.1 are detected

How to Mitigate CVE-2026-73364

Immediate Actions Required

Update the Flexible Subscriptions plugin to a version above 1.8.1 as soon as the vendor publishes a fixed release
Deactivate and remove the plugin if a patched version is not yet available and the functionality is not critical
Review WordPress user accounts, sessions, and installed plugins for unauthorized changes

Patch Information

Refer to the Patchstack Plugin Vulnerability Report for the latest patched version guidance. Apply the update through the WordPress admin dashboard or via WP-CLI once available.

Workarounds

Deploy a virtual patching rule at the WAF layer to block requests containing PHP serialization signatures directed at plugin endpoints
Restrict access to the plugin's HTTP endpoints using IP allowlisting where feasible
Disable the plugin until a vendor patch is applied to eliminate the exposed sink

bash

# Update the plugin via WP-CLI once a fixed version is available
wp plugin update flexible-subscriptions

# Or deactivate and remove the plugin as an interim measure
wp plugin deactivate flexible-subscriptions
wp plugin delete flexible-subscriptions