Subscribe To Comments Reloaded CVE-2024-31249

Exploitation requires that the Subscribe To Comments Reloaded plugin be installed and active on a WordPress site running version 220725 or earlier. The critical enabling condition - consistent with the PR:N/AV:N CVSS assignment - is that the plugin's log file must reside in a publicly web-accessible directory without server-level access restrictions. Sites that enforce deny-all rules on .log files via .htaccess or nginx config, or that store logs outside the webroot, are not exploitable via direct HTTP access. There is no required user interaction, no authentication, and no complex precondition beyond the log file being reachable. Limiting factors: sites with a WAF or plugin that restricts direct file access under wp-content, or WordPress hardened per standard security guides (e.g., deny access to non-PHP files in plugin directories), significantly reduce exploitability despite the AV:N vector.

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) scores 7.5 and implies fully unauthenticated remote exploitation with high confidentiality impact. However, a PR:N rating for a CWE-532 vulnerability is notable: log file exposure at this privilege level presupposes the log is stored in a publicly accessible web directory, which is a common but not universal pattern in WordPress plugins. If the log file is protected behind wp-admin or requires filesystem access, the realistic CVSS would be closer to PR:H and AV:L, dramatically lowering the effective risk. EPSS at 0.76% (73rd percentile) reflects moderate algorithmic risk, yet no active exploitation or public exploit code has been confirmed. The gap between the high CVSS score and the low EPSS suggests this is unlikely to be mass-exploited imminently, but the unauthenticated read path - if confirmed - makes it a straightforward target for automated scanners. CRITICAL NOTE: The exact sensitive data type and log file accessibility path are not described in the available data; risk assessment assumes web-accessible log placement consistent with the PR:N CVSS assignment.

An unauthenticated attacker runs a scanner or manually requests the predictable log file path under the plugin's WordPress directory (e.g., /wp-content/plugins/subscribe-to-comments-reloaded/logs/debug.log) and retrieves its contents directly over HTTP. The log file contains sensitive subscriber data, tokens, or other runtime information written by the plugin during normal operation. No credentials or prior authentication are required if the file is web-accessible.