Executive brief
WooCommerce Subscriptions is a popular WordPress plugin for managing subscription-based products on e-commerce stores. When High-Performance Order Storage is enabled, the plugin fails to validate user input before unserializing it, allowing unauthenticated attackers to execute arbitrary code on the server. This can lead to complete compromise of the online store, including theft of customer data and payment information.
Technical details
The vulnerability is a PHP Object Injection (CWE-94) caused by unsafe deserialization of untrusted user input without validation. When High-Performance Order Storage is enabled in WooCommerce, the plugin processes attacker-controlled input through PHP's unserialize() function. An attacker can exploit gadget chains present in bundled dependencies to escalate this object injection into Remote Code Execution (RCE). The attack requires no authentication and is accessible over the network. The vulnerability affects versions before 9.1.0, with fixes released in versions 7.9.1, 8.8.2, and 9.1.0 depending on the release branch.
Affected products
- WooCommerce Subscriptions before 9.1.0 (also affects 7.x before 7.9.1 and 8.x before 8.8.2)
Timeline
- 2026-08-10: disclosed
- 2026-08-12: advisory
- 2026-08-12: patched: Fixes released in 7.9.1, 8.8.2, and 9.1.0