CVE-2026-91830
CVE-2026-91830 · Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment Cookie
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions.
CVSS 6.5 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
subscribe to comments
- Versions
- ≥ 0, < 2.3.3: Affected (semver)
Update to 2.3.3