Subscribe To Comments Reloaded <= 240119 - Improper Authorization to Unauthenticated Arbitrary Subscription Management
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a leaked secret key and usage of a weak hash generation algorithm in all versions up to, and including, 240119. This makes it possible for unauthenticated attackers to extract the global key from any public post page, forge authorization keys and manage comment subscription preferences for arbitrary users
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-4409
- 2026-10-03 Alias added: GHSA-gwh7-h25p-fjxv
References
Other 4
- https://www.wordfence.com/threat-intel/vulnerabilities/id/91f9235e-f578-475f-92c3-34062d6d1e3d?source=cve
- https://plugins.trac.wordpress.org/browser/subscribe-to-comments-reloaded/tags/240119/wp_subscribe_reloaded.php#L1613
- https://plugins.trac.wordpress.org/browser/subscribe-to-comments-reloaded/tags/240119/utils/stcr_utils.php#L164
- https://plugins.trac.wordpress.org/browser/subscribe-to-comments-reloaded/tags/240119/templates/user.php#L37
More wpkube vulnerabilities
- TI-2024-11789 Simple Basic Contact Form < 20250114 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
- TI-2022-03869 Simple Basic Contact Form < 20221201 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
- TI-2021-03219 Missing authorization in wpkube Social Sharing Plugin – Kiwi CVSS 3.1CRITICAL 9.8
- TI-2024-20625 WordPress Subscribe To Comments Reloaded plugin <= 220725 - Sensitive Data Exposure vulnerability CVSS 3.1HIGH 7.5
- TI-2024-10151 Authors List <= 2.0.4 - Unauthenticated Arbitrary Shortcode Execution via update_authors_list_ajax CVSS 3.1HIGH 7.3
- TI-2024-03857 Simple Basic Contact Form <= 20240502 - Unauthenticated Arbitrary Shortcode Execution CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-4409 · CVE Program
- CVE-2026-4409 · NVD
- FIRST EPSS
- GHSA-gwh7-h25p-fjxv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences