CVE-2026-18391

CVE-2026-18391 in WooCommerce Subscriptions is a PHP Object Injection vulnerability that achieves RCE only through a gadget chain residing in bundled dependencies — most notably Doctrine. The CVSS 9.8 rating heavily weights that gadget chain's presence, but that chain isn't WooCommerce Subscriptions' code. The actual exploitability depends entirely on which library versions are bundled and whether researchers have already documented exploitable gadgets for those versions. This makes the vulnerability partially transferable to any site running the same library independently. There's a critical configuration dependency: High-Performance Order Storage (HPOS) enables the unserialization code path. Sites not using HPOS — typically older or less actively maintained deployments — are immune by default. Meanwhile, sites that upgraded to HPOS for performance benefits (WooCommerce's recommended configuration) are now in the vulnerable state. This inverts the typical security-compatibility tradeoff where newer, better-maintained sites face lower risk. The patch in version 9.1.0 addresses the immediate entry point, but the gadget-containing library remains bundled. This means future deserialization pathways in the same code base could become exploitable. The systemic issue is that WordPress plugin development structurally rewards bundling over dependency sharing — Composer adoption is inconsistent, autoloading standards are unenforced, and plugin authors can't rely on shared libraries being present. The vulnerability surface created by bundling is a function of researcher attention over time, not code quality at shipping. This is a recurring pattern with Doctrine and Symfony serialization components in WordPress plugins. Operationally: prioritize patching WooCommerce Subscriptions installations using HPOS, as those are both the vulnerable subset and the high-value targets attackers will scan first. Sites on legacy storage are lower-priority. The broader exposure is how many other WooCommerce ecosystem plugins bundle the same library versions without security scrutiny — the same gadget chain now serves as infrastructure for attacking any plugin carrying those dependencies.

Reviewed through automated stages and approved by a human before publication.