External risk intelligence

WooCommerce Subscriptions PHP Object Injection Leading to RCE

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-18391

This vulnerability affects a WooCommerce plugin, which is typically deployed as a public-facing web application. Since these applications are designed to be accessed via the internet to facilitate e-commerce operations, the vulnerable component is commonly reachable by external users.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a popular e-commerce plugin for WordPress, specifically affecting stores using a particular performance enhancement. This issue allows unauthenticated attackers to inject malicious code, potentially leading to full system compromise by executing arbitrary commands on the server. The main concern at this time is to confirm if this plugin is in use and if the specific performance feature is enabled.

Unauthenticated code injection in e-commerce plugin.
Enables remote code execution on affected stores.
Confirm plugin use and feature enablement.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending crafted data to a WooCommerce store that has High-Performance Order Storage enabled. This allows the attacker to trigger a PHP Object Injection, which can then be escalated to Remote Code Execution using existing components within the plugin's dependencies.

No authentication required.
Unserialization of user input.
Risk of remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated users to execute arbitrary code on a WordPress site with High-Performance Order Storage enabled. This could lead to a complete compromise of the affected store and its data.

Website code and data at risk.
Via crafted input exploiting deserialization.
Full site compromise and data theft.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the WooCommerce Subscriptions plugin likely impacts e-commerce platform administrators and the teams responsible for managing their WordPress instances. The first practical step is to identify all WooCommerce instances, determine if High-Performance Order Storage is enabled, and confirm which instances are externally accessible or handle critical business data. Once identified, the accountable application owner or platform team should be engaged to plan remediation, potentially involving vendor coordination for the plugin update.

Platform or application owners should address this.
Verify High-Performance Order Storage is enabled.
Plan coordinated plugin updates and testing.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WooCommerce Subscriptions plugin?

It is a WordPress extension that enables stores to sell products with recurring payment models, such as subscriptions, memberships, or service retainers. By automating billing cycles and managing recurring orders, it serves as a central component for e-commerce platforms. This vulnerability specifically affects instances where the plugin's data processing architecture relies on High-Performance Order Storage.

What does PHP Object Injection mean for CVE-2026-18391?

This is a security weakness where the software improperly handles user-provided data before processing it. In this case, the application unserializes input without validation, which attackers can abuse to inject malicious objects. This manipulation leverages existing code patterns within the plugin's dependencies to execute arbitrary commands on the server, a scenario known as Remote Code Execution.

How does an attacker trigger this vulnerability?

An attacker triggers the flaw by sending specially crafted data to an affected WordPress store. Critically, this does not require any login credentials or user account permissions. If the High-Performance Order Storage feature is disabled on the site, the specific code path that processes the vulnerable input remains inactive, meaning the bug cannot be triggered in that configuration.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a high-priority concern because WooCommerce plugins are designed to be public-facing to process customer transactions. Because these applications are inherently accessible via the internet, there is a strong likelihood that your store is reachable by external actors who could attempt to exploit this vulnerability.

What are the first steps to take if I use this plugin?

Start by identifying all WordPress sites in your environment running this plugin. Check the administrative settings for each site to see if High-Performance Order Storage is enabled. If it is, coordinate with your technical team to verify the plugin version and prepare for an update to version 9.1.0 or higher to address the underlying input validation failure.

References

wpscan.com/vulnerability/191f76cf-e5bd-4a37-ac1c-9187cea2aa27/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.