WooCommerce Subscriptions contains a critical PHP Object Injection vulnerability (CVE-2026-18391, CVSS 9.8) that lets unauthenticated attackers execute arbitrary code on your server when High-Performance Order Storage (HPOS) is enabled. The fix is already available: update to version 7.9.1, 8.8.2, or 9.1.0 depending on your current branch. If you run WooCommerce Subscriptions with HPOS turned on, this is a same-day update — not something to schedule for next maintenance window.
What the Vulnerability Is
PHP Object Injection happens when user-supplied data reaches PHP’s unserialize() function without proper validation. An attacker crafts a malicious serialized object and sends it in a request. PHP reconstructs the object, and if the application or any bundled library contains a class with dangerous “magic methods” like __destruct() or __wakeup(), those methods run automatically. A chain of such classes — called a gadget chain — can be assembled to run arbitrary system commands on the server.
In this case, WooCommerce Subscriptions was unserializing order-related data from storage without validating it first, specifically on stores where HPOS is active. HPOS (High-Performance Order Storage) is WooCommerce’s modern architecture that stores orders in dedicated custom database tables instead of the legacy wp_postmeta structure. The vulnerable code path reads certain subscription data from those tables and passes it to unserialize() without sanitizing the payload. Because HPOS is now the default and recommended configuration in current WooCommerce installs, a large share of Subscriptions users are in the affected configuration.
The vulnerability is unauthenticated — no account, login, or prior access to your site is required to trigger it. WPScan published the advisory on August 10, 2026, assigning a CVSS score of 9.8.
Are You Affected?
You are in the vulnerable range if all three of the following are true:
- You have the WooCommerce Subscriptions plugin installed (the premium plugin from WooCommerce.com — not a third-party subscriptions plugin like Subscriptions for WooCommerce by WPSwings).
- The installed version is below the patched release for your branch: 7.9.1 (7.x), 8.8.2 (8.x), or 9.1.0 (9.x).
- High-Performance Order Storage is enabled: WooCommerce > Settings > Advanced > Features > High-Performance Order Storage (COT).
If HPOS is disabled, the specific injection pathway in this CVE does not apply. But that is not a reason to skip the update — disabling HPOS is not a long-term strategy, and future patches for WooCommerce Subscriptions will likely address other issues as well.
How to Check Your Current Version
- Log in to your WordPress dashboard and go to Plugins > Installed Plugins.
- Find “WooCommerce Subscriptions” in the list. The version number appears beneath the plugin name.
- Compare it against the patched versions: 7.9.1 for the 7.x branch, 8.8.2 for 8.x, or 9.1.0 for 9.x.
- If your installed version is below the patched release, update immediately from the same Plugins page.
If you manage plugin updates manually — some stores delay updates to avoid breaking customized checkout flows — you can download the patched version from your WooCommerce.com account under My Subscriptions > Downloads, then upload it via Plugins > Add New > Upload Plugin.
What to Do Right Now
| Action | Priority | Notes |
|---|---|---|
| Update WooCommerce Subscriptions | Immediate | Patched in versions 7.9.1, 8.8.2, and 9.1.0 |
| Confirm HPOS status | Immediate | WooCommerce > Settings > Advanced > Features |
| Audit for new admin accounts | Within 24 hours | Users > All Users — filter by Administrator role |
| Review server access logs | Within 24 hours | Look for unexpected POST requests to WooCommerce REST or WC AJAX endpoints |
| Enable a web application firewall | This week | Wordfence, Cloudflare WAF, or Sucuri intercept exploit attempts before they reach PHP |
| Run a server-side malware scan | This week | Imunify360 (many hosts), MalCare, or Wordfence scanner |
If You Cannot Update Immediately
There are situations where an immediate plugin update is not possible — you are mid-launch, a compatibility test is in progress, or a developer needs to review changes first. If you must wait even a few hours, take these interim steps:
- Temporarily disable HPOS. Go to WooCommerce > Settings > Advanced > Features and turn off High-Performance Order Storage. This removes the specific code path the CVE exploits. Re-enable HPOS after you apply the patch.
- Activate Wordfence in Protection Mode. Wordfence’s firewall can block known PHP Object Injection patterns even before a plugin-specific rule is published for this CVE.
- Restrict wp-login.php and REST API access by IP if your store does not rely on unauthenticated REST access. This is a blunt measure but reduces the attack surface while you prepare the update.
Do not leave HPOS disabled permanently. WooCommerce is moving toward requiring HPOS for full compatibility with future versions of the platform, and running without it creates its own long-term maintenance headaches.
How to Check if You Were Already Compromised
If your store ran a vulnerable version of WooCommerce Subscriptions with HPOS enabled before you patched, a quick post-compromise check is worth doing. Patching closes the door — it does not remove an attacker who is already inside.
- Check for rogue admin accounts. Go to Users > All Users, filter by the Administrator role, and verify every account. An attacker’s first move after successful RCE is typically to create a persistent backdoor admin account.
- Look for PHP files in wp-content/uploads/. That directory should contain only media files. Any .php file in uploads is a strong indicator of a webshell being dropped.
- Run a server-side malware scan. If your host offers Imunify360 or a similar tool, run it now. Plugin-level scanning misses files injected outside the WordPress directory tree.
- Verify wp-config.php has not been modified. Check your database credentials, secret keys, and any stored API keys — compare against a recent backup if you have one.
- Check your WooCommerce payment gateway settings. One pattern attackers use on compromised WooCommerce stores is to swap API keys to silently redirect payment data. Log in to your payment provider’s dashboard independently and confirm your keys match.
The Broader Lesson: HPOS Changes the Plugin Attack Surface
HPOS is the right direction for WooCommerce — purpose-built order tables improve query performance and make the data model more maintainable than the old post/meta design. But the migration introduces a new class of risk: plugins that were written for the old data model need to be updated to handle the new storage layer correctly. CVE-2026-18391 is partly a consequence of that migration — serialization code written for the post-meta world was applied to the HPOS data flow without the input validation it needed.
The practical takeaway is that any WooCommerce plugin that reads or writes order data should be treated as high-priority for updates whenever HPOS-related patches are released. This is not a WooCommerce Subscriptions-specific problem. As the broader plugin ecosystem catches up to HPOS, similar issues may surface in other order-adjacent plugins.
Keeping WooCommerce plugins updated is the single highest-leverage security action for a WooCommerce store. If you want help reviewing your plugin stack, assessing HPOS compatibility, or doing a targeted security audit of your WooCommerce setup, reach out to us here. We work with WooCommerce stores directly and do not resell generic scan reports.
Frequently Asked Questions
Is my store at risk if WooCommerce Subscriptions is installed but HPOS is turned off?
The specific code path described in CVE-2026-18391 only activates when High-Performance Order Storage is enabled. If HPOS is off, this particular vulnerability is not exploitable in the way the advisory describes. That said, you should still update — disabling HPOS is not a security strategy, and the patched versions may address other issues not covered by this CVE.
Do I need to check for signs of compromise even if I update the plugin right away?
Yes, if your store ran a vulnerable version with HPOS enabled at any point before the August 10 patch, a post-compromise check is prudent. Applying the update closes the entry point, but it does not undo any changes an attacker may have already made — new admin accounts, dropped webshells, or modified gateway credentials would remain. Check for these even after patching.
Does WooCommerce automatically push updates for the Subscriptions plugin?
Automatic updates for WooCommerce Subscriptions require an active, connected WooCommerce.com licence for your site. If your licence has lapsed, was never connected, or the plugin was installed manually, WordPress will not offer or apply automatic updates. Verify your licence status under WooCommerce > Extensions > My Subscriptions in the WordPress dashboard.
Featured image: original illustration.