What is the CVSS score of EUVD-2026-57100?

EUVD-2026-57100 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 28.0%.

Which versions of WooCommerce Subscriptions are affected by EUVD-2026-57100?

WooCommerce Subscriptions plugin (versions 4.7.0 through 9.0.x) contains a critical remote code execution vulnerability affecting e-commerce platforms using WooCommerce's High-Performance Order…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-57100?

Yes, a public proof-of-concept exploit is available for EUVD-2026-57100. Prioritise patching immediately. EPSS: 28.0%.

How to fix or mitigate EUVD-2026-57100?

Within 24 hours, audit all WooCommerce installations to identify systems running Subscriptions plugin versions 4.7.0-9.0.x that have High-Performance Order Storage enabled; create a prioritized remediation list and verify current plugin version across all stores. Within 7 days, upgrade all affected instances directly to WooCommerce Subscriptions version 9.1.0 and perform functional testing on subscription workflows (renewal, cancellation, payment processing) in a staging environment before applying to production. Within 30 days, conduct a forensic log review for indicators of exploitation (database injection attempts, serialization attacks, unexpected code execution), verify 100% remediation compliance through automated scanning, and document any instances that were compromised during the vulnerability window.

WooCommerce Subscriptions EUVD-2026-57100

| CVE-2026-18391 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-12 WPScan

GHSA-5736-34m2-3cxc

PHP WordPress RCE File Upload Woocommerce Subscriptions Unknown

9.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote object injection to RCE gives AV:N/AC:L/PR:N/UI:N with full C/I/A impact; HPOS is a deployment precondition, not an access barrier, so PR stays N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 20:36 vuln.today

CVSS changed

Aug 12, 2026 - 20:22 NVD

9.8 (CRITICAL)

Patch available

Aug 12, 2026 - 07:16 EUVD

CVE Published

Aug 12, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 12, 2026 - 06:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.

Articles & Coverage 1

News Critical PHP Object Injection RCE in WooCommerce Subscriptions Plugin - CVE-2026-18391 Aug 13, 2026

AnalysisAI

PHP Object Injection escalating to unauthenticated remote code execution affects the WooCommerce Subscriptions WordPress plugin from version 4.7.0 up to (but not including) 9.1.0, but only on stores running WooCommerce's High-Performance Order Storage (HPOS). The plugin unserializes attacker-controlled input without validation, and a gadget chain in bundled dependencies turns that into arbitrary code execution. Publicly available exploit code exists and a vendor patch (9.1.0) is available, but this is not listed in CISA KEV; the EPSS score of 28% is elevated, indicating meaningful exploitation probability.

Technical ContextAI

WooCommerce Subscriptions is a commercial WordPress/WooCommerce extension that manages recurring billing and subscription orders. The flaw stems from passing untrusted input to PHP's unserialize() - the classic PHP Object Injection (POI) pattern (properly CWE-502, though the record is tagged CWE-434 Unrestricted File Upload, a likely mislabel given the described mechanism). When HPOS is enabled, order data is stored in dedicated custom tables rather than the legacy wp_posts/postmeta structure, and the affected deserialization path is reachable in that mode. Because unserialize() reconstructs arbitrary PHP objects, an attacker who controls the serialized blob can instantiate objects whose magic methods (__wakeup/__destruct) form a 'gadget chain' - here present in the plugin's bundled dependencies - leading to code execution. The CPE cpe:2.3:a:unknown:woocommerce_subscriptions:*:*:*:*:*:*:*:* confirms the affected component but does not bound the version range.

RemediationAI

Vendor-released patch: upgrade WooCommerce Subscriptions to 9.1.0 or later, which validates input before deserialization; this is the primary and recommended fix. If immediate patching is not possible, a targeted compensating control is to disable High-Performance Order Storage (revert to legacy post-based order storage under WooCommerce > Settings > Advanced > Features), which removes the vulnerable code path - with the trade-off of losing HPOS performance and scalability benefits and requiring a data sync back to legacy tables. As additional interim controls, place the store behind a WAF with rules blocking PHP-serialized object payloads (strings containing patterns like O:<n>: in request bodies) and restrict/monitor the order-handling endpoints, accepting possible false positives on legitimate serialized data. Consult the WPScan advisory (https://wpscan.com/vulnerability/191f76cf-e5bd-4a37-ac1c-9187cea2aa27/) for exact affected paths before deploying request-filtering rules.