CVE-2026-91830
Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment Cookie
Unknown Subscribe to Comments
CVSS
6.5MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.3.3Subscribe to CommentsCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions.
Text from CVE List
Affected versions 1
- Subscribe to Commentsaffected: all versions before 2.3.3CVE List