CyberRota Analysis
AI-GeneratedThe WooCommerce Subscriptions plugin for WordPress versions prior to 9.1.0 is vulnerable to PHP Object Injection due to inadequate user input validation during the unserialization process, particularly in environments with High-Performance Order Storage enabled. This flaw allows unauthenticated users to exploit the vulnerability and potentially achieve Remote Code Execution through a crafted payload leveraging existing gadget chains in the plugin's dependencies. WordPress site administrators using this plugin should prioritize immediate updates to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.