WooCommerce shipped version 9.1.0 of its Subscriptions plugin on August 5, patching a critical vulnerability that let an unauthenticated attacker execute arbitrary code on a store’s server. The issue was assigned CVE-2026-18391 and carries a CVSS score of 9.8, about as bad as this rating gets. If you run WooCommerce Subscriptions and haven’t updated in the last week and a half, this is worth stopping to check right now.
What the vulnerability actually is
The bug lives in how the plugin handles unserialization of user-supplied data, but only on stores that have High-Performance Order Storage (HPOS) turned on. Without validating that input first, an attacker could trigger a PHP Object Injection and chain it through a gadget already present in the plugin’s bundled dependencies to reach full remote code execution, no login required. NVD lists the affected range as version 4.7.0 through 9.0.x, so this has been sitting in the plugin for a long time before anyone caught it.
WooCommerce’s own security advisory is more general than the CVE record, describing “several security vulnerabilities” with the worst allowing “an unauthorized user to assume site control.” That lines up with what NVD and WPScan’s vulnerability database describe for CVE-2026-18391 specifically. The company says the flaw was found through an internal security review, not by watching it get exploited, and states it has no evidence of any store being compromised or any customer data accessed.
Who’s actually exposed
Two things have to both be true for a store to be at risk: WooCommerce Subscriptions below 9.1.0, and HPOS enabled. HPOS has been WooCommerce’s recommended default for new stores for a while now, so plenty of merchants running recurring billing or membership products through Subscriptions will meet both conditions without having thought about it. If you’re not sure whether HPOS is on, it’s under WooCommerce > Settings > Advanced > Features.
This isn’t the only WooCommerce-adjacent plugin patched this month. WooCommerce Social Login and a Stripe extension both had their own fixes land in the same window, which is a decent sign that the plugin family got a closer look recently rather than one isolated bug.
What to do about it
- Update WooCommerce Subscriptions to 9.1.0 or later immediately, before anything else on this list.
- If the site has been running an older version with HPOS on for a while, don’t assume the “no evidence of compromise” line covers you. Check admin user accounts for anything unfamiliar, look for unexpected files in the uploads directory, and review recent order and file activity.
- Rotate API keys and reset admin passwords if anything looks even slightly off. Unauthenticated RCE means an attacker who found this before the patch didn’t need your credentials to get in.
For stores where nobody’s been keeping close tabs on plugin versions across dozens of installs, this is the kind of gap a WooCommerce Development audit is built to catch before it turns into an incident report instead of a changelog entry.
