WooCommerce Subscriptions CVE-2026-18391

Exploitation requires the store to have WooCommerce High-Performance Order Storage (HPOS) enabled - this is the explicit precondition named in the description; without HPOS the vulnerable unserialize path is not reached. The plugin must be a vulnerable version (4.7.0 to below 9.1.0). Given the CVSS vector (PR:N/UI:N), no authentication or user interaction is required once HPOS is active, and the gadget chain must be present in the bundled dependencies (which the advisory states it is). The primary limiting factor is therefore the non-default HPOS configuration; stores still on legacy order storage are not exploitable via this path.

Signals are mostly aligned toward high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) indicates a fully remote, unauthenticated, low-complexity attack with total impact, and the description explicitly says unauthenticated users can reach RCE. Public exploit code exists and EPSS is elevated at 28%, well above baseline, reinforcing that exploitation is plausible in the near term. The key mitigating factor is that exploitation is conditional on High-Performance Order Storage being enabled - a non-universal configuration - so the effective attack surface is narrower than the raw 9.8 suggests. It is NOT in CISA KEV, so despite public POC there is no confirmation of active in-the-wild exploitation. Note the CWE mismatch: CWE-434 (file upload) is recorded, but the described root cause is deserialization/object injection (CWE-502); this should be verified against the WPScan advisory before basing detection rules on the CWE.

An unauthenticated attacker on a WooCommerce store that has HPOS enabled submits a request containing a crafted PHP-serialized payload to an order-processing endpoint. The plugin unserializes it without validation, instantiating a malicious object that triggers a gadget chain in a bundled dependency, executing attacker-supplied PHP on the server. Public exploit code exists, and the low-complexity, no-interaction CVSS profile means the attack can be automated at scale against exposed stores.