Description

Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-19T13:18:07.520Z",
  "pubdate": "2026-08-19T13:18:07.520Z",
  "executiveSummary": "A PHP Object Injection vulnerability exists in the Flexible Subscriptions product in versions up to and including 1.8.1. This security flaw arises from the insecure handling and deserialization of untrusted user-supplied data within the application logic. Successful exploitation of this vulnerability allows an authenticated or unauthenticated attacker, depending on the specific endpoint exposure, to inject arbitrary PHP objects into the application scope.\nThe primary impact of this vulnerability is severe, potentially leading to Remote Code Execution (RCE), arbitrary file deletion, or sensitive data disclosure, heavily dependent on the presence of compatible gadget chains within the application or loaded third-party libraries. The risk implications are critical, as an attacker capable of executing arbitrary object deserialization can subvert application control flows and compromise the underlying server infrastructure.\nThe affected system comprises the Flexible Subscriptions plugin operating on PHP-based environments. Exploitation capabilities require the attacker to craft a malicious serialized payload containing specific gadget chains tailored to the application's runtime environment. No explicit patch version beyond the vulnerable boundary of 1.8.1 is detailed in the provided context, necessitating strict adherence to defensive remediation guidelines to neutralize the deserialization vector.",
  "technicalDetails": "The root cause of the vulnerability stems from the insecure usage of PHP's native unserialize() function on data controlled by an external actor without prior validation, sanitization, or type checking within the Flexible Subscriptions <= 1.8.1 codebase. When the vulnerable component processes user-supplied input intended for state restoration or configuration parsing, it instantiates PHP objects directly from the serialized string representation.\nThe vulnerable component involves the internal modules of Flexible Subscriptions responsible for handling persistent data structures or request parameters that accept serialized objects. The affected versions strictly encompass all releases up to and including 1.8.1. Network exposure is present via standard web interfaces exposed by the application where HTTP requests can deliver the malicious payload to the vulnerable endpoint.\nAuthentication and privilege requirements depend on the specific entry point exposed by the vulnerable code path within the plugin, though high-impact object injection flaws frequently bypass standard authorization boundaries if the deserialization routine executes prior to session validation or if exposed via publicly accessible AJAX actions or REST API routes.\nThe attack flow proceeds in a structured sequence: First, the attacker identifies a vulnerable entry point within Flexible Subscriptions that accepts input and passes it into a deserialization sink like unserialize(). Second, the attacker crafts a malicious payload containing a serialized PHP object structure. This structure leverages available PHP classes defined within the application or dependent plugins that implement magic methods such as __wakeup() or __destruct(). Third, the attacker transmits this payload via HTTP requests to the target application.\nUpon receipt, the vulnerable component processes the input using the insecure deserialization function. PHP automatically instantiates the malicious object classes and triggers the associated magic methods during the object's lifecycle. Post-exploitation impact heavily relies on the execution of these gadget chains, which can manipulate application state, invoke system commands, read or write arbitrary files on the filesystem, or facilitate further internal network pivoting, culminating in total compromise of the host running Flexible Subscriptions."
}