Security readout for executives and security teams
Plain-English summary
A critical flaw in WooCommerce Subscriptions can let an unauthenticated internet user take control of a vulnerable online store. Exposure requires a version earlier than 9.1.0 and High-Performance Order Storage enabled. Successful exploitation could expose customer data, alter transactions, install malicious content, or disrupt commerce.
Executive priority
Prioritize emergency remediation for revenue-generating or customer-data stores. Patch exposed instances immediately and initiate compromise review where vulnerable configurations were internet-accessible. The potential impact includes full site takeover, data theft, transaction manipulation, malware distribution, and operational outage.
Technical view
Unvalidated user input is unserialized when High-Performance Order Storage is enabled, creating PHP object injection. A gadget chain in bundled dependencies can escalate the flaw to remote code execution without authentication or user interaction. The supplied CVSS 3.1 score is 9.8, with high confidentiality, integrity, and availability impact.
Likely exposure
Internet-accessible WordPress stores using WooCommerce Subscriptions earlier than 9.1.0 with High-Performance Order Storage enabled are likely exposed. The bundle's structured affected-version entry mentions 4.7.0 with an inconsistent default status, so asset owners should verify versions against vendor guidance.
Exploitation context
The source bundle links a WPScan entry tagged as an exploit and technical description, indicating public exploitation information may exist. However, this CVE is not listed as KEV in the supplied data, and no cited evidence confirms active exploitation. Treat exposed stores as urgent because exploitation requires no authentication.
Researcher notes
The supplied description establishes a conditional PHP object-injection path and dependency gadget chain, but provides limited endpoint and implementation detail. The supplied CWE-434 and CWE-94 classifications do not directly describe unsafe deserialization. The affected-version metadata is internally inconsistent, so researchers should rely on the stated pre-9.1.0 boundary while confirming vendor records.
Mitigation direction
- Update WooCommerce Subscriptions to version 9.1.0 or later.
- Confirm the installed package is genuine and the upgrade completed successfully.
- Restrict public access temporarily if an affected store cannot be updated promptly.
- Review current vendor guidance for any additional mitigations or incident-response recommendations.
- Preserve relevant logs and backups before investigating suspected compromise.
Validation and detection
- Inventory WooCommerce Subscriptions versions across all WordPress stores.
- Determine whether High-Performance Order Storage is enabled on each store.
- Verify no deployed instance remains below version 9.1.0.
- Review web, WordPress, and hosting logs for unexplained unauthenticated requests or code execution.
- Check for unexpected files, plugins, administrators, scheduled tasks, or configuration changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-434: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-18391 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/191f76cf-e5bd-4a37-ac1c-9187cea2aa27/CVE reference, WPScan · exploit, vdb-entry
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.