External risk intelligence

Flexible Subscriptions PHP Object Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-73364

The vulnerability affects a WordPress plugin, which is typically used to extend the functionality of public-facing websites. As a web-based application component, it is commonly deployed in environments that are directly reachable from the internet to facilitate user interactions or subscription management.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a widely used PHP application component, potentially allowing unauthorized access and modification of systems. This issue affects how the component handles certain data inputs, creating an opening for malicious actors. The main concern is confirming whether this specific application component is in use within our environment.

Uncontrolled data input can lead to system compromise.
Affects common web application components.
Verify relevance to our deployed systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a crafted request to a web application using the affected plugin. This request would target the PHP Object Injection flaw, which allows for the injection of malicious PHP objects. Successful exploitation could lead to the execution of arbitrary code and compromise of the entire system.

No authentication required.
Triggered by specially crafted requests.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A PHP Object Injection vulnerability in the Flexible Subscriptions plugin could allow an unauthenticated attacker to inject malicious PHP objects into the application. This may lead to the execution of arbitrary code, potentially affecting the integrity and availability of the affected system.

System data could be compromised.
Malicious code could be injected remotely.
System integrity and availability may be impacted.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical PHP Object Injection vulnerability in the Flexible Subscriptions plugin requires immediate attention from teams managing customer-facing web applications. The first step is to locate all instances of the affected plugin, determine their internet reachability and business criticality, and identify the specific application owner. Remediation planning should then proceed based on the assessed risk, prioritizing critical or exposed systems.

Application owners should own the issue.
Verify plugin presence and external exposure.
Plan remediation or temporary risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Flexible Subscriptions plugin?

Flexible Subscriptions is a WordPress plugin used to manage recurring billing, memberships, and subscription services directly on a website. It automates how sites handle subscriber accounts and payments, acting as an extension to the core WordPress platform to provide specialized commerce functionality.

What does PHP Object Injection mean for CVE-2026-73364?

This vulnerability is classified as CWE-502, Deserialization of Untrusted Data. It occurs when the software takes user-provided data and converts it back into a PHP object without proper validation. An attacker can manipulate this process to inject their own malicious objects, which can force the application to execute unintended commands or corrupt its internal logic.

How can an attacker trigger this vulnerability?

The flaw is triggered when an attacker sends a specially crafted, malicious request to the web application. Because the vulnerability allows for unauthenticated access, the attacker does not need to have a user account or special permissions on the site to initiate the attack. Simple, standard requests that do not contain malicious serialized objects will not trigger the bug.

Why is this CVE considered relevant to my environment?

Halo Surface Signal indicates that because this is a WordPress plugin, it is often installed on websites meant to be accessed by the public. Since it is designed to facilitate user subscriptions, it is frequently internet-facing, meaning unauthorized parties can reach the vulnerable component directly from the web without needing internal access.

What steps should I take if I use this software?

First, inventory your systems to confirm if the Flexible Subscriptions plugin is installed and running version 1.8.1 or earlier. Once identified, determine which instances are accessible from the internet. Coordinate with the application owners to manage the risk, as this plugin component requires immediate attention to protect the integrity of your web environment.

References

patchstack.com/database/wordpress/plugin/flexible-subscriptions/vuln…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.