CVE-2026-73364

PHP Object Injection vulnerability in Flexible Subscriptions plugin versions up to and including 1.8.1. Allows an attacker to inject malicious PHP objects, potentially leading to unauthorized access or code execution.

Risk includes potential takeover of the WordPress site, data theft, or privilege escalation. The attack may be performed without authentication if the vulnerable endpoint is publicly accessible.

Immediately update the Flexible Subscriptions plugin to a version newer than 1.8.1. Also check logs for suspicious requests.