CVE-2026-73364: WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability
Published Aug 19, 2026
·Updated
Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions.
Affected Software
1 affected component
WordPress Flexible Subscriptions<=1.8.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Flexible Subscriptions pluginto a version that resolves this vulnerability.Fixed in 1.8.2
Event History
Aug 19, 2026
CVE Published
via MITRE·12:38 PM
Data Sourced
via MITRE·12:38 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is described as customer PHP object injection. Exploitation does not require authentication or user interaction, according to the supplied vector (PR:N/UI:N).
2
What is the potential impact?
The supplied severity vector indicates network-reachable exploitation with low attack complexity and high impact on confidentiality, integrity, and availability. The issue is rated critical at 9.8.
3
Which plugin versions are affected?
Flexible Subscriptions versions 1.8.1 and earlier are identified as affected.