CVE-2026-18391CWE-434unrestricted-file-upload

CVE-2026-18391

Critical · published August 12, 2026

CVSS v3.1

9.8

EPSS

Percentile

61.3

In the wild

Unconfirmed

What it is

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.

The record

Technical detail

CVSS v3.1: 9.8 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00963 · 61.3th percentile
Weakness: CWE-434 · Unrestricted Upload of File with Dangerous Type
Published: 2026-08-12T10:20Z

References (1)

https://wpscan.com/vulnerability/191f76cf-e5bd-4a37-ac1c-9187cea2aa27/ · [email protected]

EPSS history

Timeline

12 AUG 06:00Z
WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection
cvelistv5