What is the CVSS score of CVE-2026-73364?

CVE-2026-73364 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Flexible Subscriptions are affected by CVE-2026-73364?

WP Desk Flexible Subscriptions plugin (versions through 1.8.1) contains a critical unauthenticated remote code execution vulnerability allowing attackers to compromise WordPress installations and…

How to fix or mitigate CVE-2026-73364?

Within 24 hours, immediately deactivate and remove the WP Desk Flexible Subscriptions plugin from all affected WordPress instances (versions ≤ 1.8.1) to prevent active exploitation. Within 7 days, monitor WP Desk and Patchstack security advisories for patch availability and plan a controlled testing and upgrade process for when a fix is released. Within 30 days, once the vendor releases a patched version (version > 1.8.1), upgrade all instances to the patched version, validate in a staging environment, and re-enable the plugin on production systems following security assessment.

Flexible Subscriptions CVE-2026-73364

EUVD-2026-62384 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-19 Patchstack

GHSA-r5mm-45xf-59fx

PHP WordPress Deserialization Wordpress Plugin Flexible Subscriptions Wpdesk

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable customer endpoint (AV:N/AC:L/PR:N/UI:N) with deserialization enabling code execution justifies high C/I/A; scope unchanged within the PHP application.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 13:25 vuln.today

CVE Published

Aug 19, 2026 - 12:38 cve.org

CRITICAL 9.8

DescriptionCVE.org

Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions.

Articles & Coverage 1

News Critical PHP Object Injection in WP Desk Flexible Subscriptions - CVE-2026-73364 Aug 20, 2026

AnalysisAI

Unauthenticated PHP object injection in the WP Desk Flexible Subscriptions WordPress plugin (versions <= 1.8.1) lets remote attackers submit crafted serialized data that the plugin deserializes, enabling exploitation of PHP object magic methods. Reported by Patchstack and rated CVSS 9.8, the flaw can escalate to remote code execution, data theft, or site takeover when a suitable POP gadget chain is present in the plugin, WordPress core, or another installed extension. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is Flexible Subscriptions (vendor slug wpdesk, CPE cpe:2.3:a:wpdesk:flexible_subscriptions), a WooCommerce/WordPress plugin used to sell and manage recurring subscription products. The root cause is CWE-502 (Deserialization of Untrusted Data): the plugin passes attacker-influenced input to PHP's unserialize() without validating or restricting the object types instantiated. When PHP unserializes a crafted string, it can materialize arbitrary objects whose magic methods (__wakeup, __destruct, __toString) fire automatically; chaining these across available classes (a 'POP chain') turns object instantiation into concrete actions such as file writes, SQL, or command execution. The 'Customer' qualifier in the description indicates the injection point is reachable through customer-facing subscription functionality rather than an admin-only screen.

RemediationAI

No vendor-released patch version was identified in the provided data; because 1.8.1 and earlier are affected, upgrade to the next release published by WP Desk above 1.8.1 once confirmed via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/flexible-subscriptions/vulnerability/wordpress-flexible-subscriptions-plugin-1-8-1-php-object-injection-vulnerability) and the plugin changelog - do not assume a version number that is not published. Until a fix is confirmed, compensating controls include deactivating the Flexible Subscriptions plugin (trade-off: subscription checkout and management break), placing a WAF or Patchstack virtual patch in front of the site to block serialized-object payloads reaching the customer subscription endpoints (trade-off: signature bypasses possible), and restricting or monitoring the specific customer-facing request handlers that accept the untrusted input. Because exploitation depends on gadget chains, keeping WordPress core and all other plugins updated reduces the pool of usable POP gadgets (trade-off: does not remove the injection sink itself).