Description

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-12T06:20:14.167Z",
  "pubdate": "2026-08-12T06:20:14.167Z",
  "executiveSummary": "An unauthenticated PHP Object Injection vulnerability exists in the WooCommerce Subscriptions WordPress plugin prior to version 9.1.0.\nThe security flaw arises from a failure to properly validate user-supplied input prior to executing a PHP unserialize operation on e-commerce stores configured with High-Performance Order Storage enabled.\nSuccessful exploitation of this vulnerability allows unauthenticated remote attackers to escalate the object injection primitive to Remote Code Execution by leveraging a suitable gadget chain present within the bundled dependencies of the application.\nThe impact of this vulnerability is critical, potentially allowing complete system compromise, arbitrary code execution, and unauthorized access to the underlying hosting server environment.\nExploitation requires network access to the vulnerable WordPress instance with High-Performance Order Storage enabled, but does not necessitate prior authentication or privileged access levels.",
  "technicalDetails": "The vulnerability is rooted in insecure deserialization practices within the WooCommerce Subscriptions plugin affecting versions prior to 9.1.0.\nThe affected component handles user-supplied input and passes it directly to the PHP unserialize() function without adequate validation or sanitization checks when High-Performance Order Storage is actively enabled on the target WooCommerce store.\nBecause PHP object instantiation via unserialize() triggers magic methods such as __wakeup() or __destruct() within instantiated classes, an attacker can supply a specially crafted serialized payload designed to interact with pre-existing classes functioning as exploitation gadgets.\nThe attack flow begins when an unauthenticated network user submits crafted input to the vulnerable endpoint handling High-Performance Order Storage operations.\nThe application ingests this data and performs an insecure unserialization routine, processing the attacker-controlled payload.\nBy chaining specific classes and methods bundled within the application's dependencies—commonly referred to as a gadget chain—the attacker manipulates application control flow during object destruction or state restoration.\nThis manipulation directly culminates in Remote Code Execution on the hosting server under the security context of the web server process.\nPost-exploitation impact includes arbitrary command execution, data exfiltration, system persistence, and lateral movement across the network infrastructure hosting the WordPress installation."
}