This vulnerability exists in WooCommerce Subscriptions versions prior to 9.1.0. When the plugin’s High-Performance Order Storage feature is enabled, it accepts serialized user data without validation, allowing an attacker to provide crafted serialized objects. The deserialization process can trigger a PHP Object Injection that leads to Remote Code Execution through a gadget chain in the plugin’s bundled dependencies. The impact is complete compromise of the affected WordPress site, allowing execution of arbitrary code with the web server’s privileges.

The affected product is the WooCommerce Subscriptions WordPress plugin for stores using High-Performance Order Storage. All installations running any version earlier than 9.1.0 are vulnerable. The problem arises only when the High-Performance Order Storage setting is enabled.

The CVE lists an EPSS score of <1% and is not listed in KEV, but it carries a CVSS score of 9.8, indicating a critical vulnerability. Attackers can likely exploit this through an HTTP request that carries malicious serialized data to the vulnerable endpoint. The lack of input validation and the presence of a gadget chain make exploitation straightforward for attackers who can send the data. Consequently, the threat level should be treated as high until the plugin is upgraded or mitigated.