Vulnerabilities / Subscribe to Comments / WPSEC-2026-0589
Subscribe to Comments <= 2.3.1 - Unauthenticated Sensitive Information Exposure via Subscription Management Keys
Medium 6.5
CWE-200Fixed in 2.3.2
- ID
- WPSEC-2026-0589
- Plugin
- Subscribe to Comments (subscribe-to-comments)
- Affected
- all versions before 2.3.2
- Remediation
- Update to 2.3.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-07
- Attack surface
- Subscribe to Comments on WPSec AttackSurface
- Fix released
- Published
Description
The Subscribe to Comments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.1 via the comment subscription form and the 'subscribe without commenting' feature. This makes it possible for unauthenticated attackers to obtain the subscription-management key of another person's e-mail address and use it to manage that person's comment subscriptions.
References
- https://wpsec.com/vuln/WPSEC-2026-0589/
- https://plugins.svn.wordpress.org/subscribe-to-comments/tags/2.3.2/
- https://wordpress.org/plugins/subscribe-to-comments/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS