What is the CVSS score of CVE-2024-31249?

CVE-2024-31249 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.8%.

Which versions of Subscribe To Comments Reloaded are affected by CVE-2024-31249?

The Subscribe To Comments Reloaded WordPress plugin exposes sensitive subscriber data-including email addresses and authentication tokens-through unauthenticated access to application log files,…

How to fix or mitigate CVE-2024-31249?

Within 24 hours, identify all WordPress installations running Subscribe To Comments Reloaded (versions 220725 and earlier) and disable the plugin or restrict access to it via Web Application Firewall rules targeting log file paths to prevent unauthenticated access. Within 7 days, implement web server-level access controls (.htaccess or server configuration) to deny unauthenticated requests to log directories, audit recent log files for unauthorized access, and research alternative comment subscription plugins with active security maintenance. Within 30 days, establish a continuous monitoring process for vendor security advisories, plan migration to a maintained alternative plugin, and conduct forensic review of log files to determine whether subscriber data was accessed during the exposure window.

Subscribe To Comments Reloaded CVE-2024-31249

HIGH

Insertion of Sensitive Information into Log File (CWE-532)

2024-04-10 audit@patchstack.com

Information Disclosure Subscribe To Comments Reloaded Wpkube

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Adopting the Patchstack-assigned vector as the log file appears web-accessible without authentication; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 12, 2026 - 18:28 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 12, 2026 - 18:22 vuln.today

cvss_changed

Severity Changed

Aug 12, 2026 - 18:22 NVD

MEDIUM HIGH

CVSS changed

Aug 12, 2026 - 18:22 NVD

5.3 (MEDIUM) 7.5 (HIGH)

CVE Published

Apr 10, 2024 - 16:15 cve.org

MEDIUM 5.3

DescriptionNVD

Insertion of Sensitive Information into Log File vulnerability in WPKube Subscribe To Comments Reloaded.This issue affects Subscribe To Comments Reloaded: from n/a through 220725.

AnalysisAI

Sensitive data exposure in the Subscribe To Comments Reloaded WordPress plugin (versions through 220725) allows unauthenticated remote attackers to retrieve information written to application log files. The plugin inserts sensitive data - likely subscriber email addresses, tokens, or configuration values - into log files that appear to be accessible without authentication, based on the PR:N/AV:N CVSS vector assigned by Patchstack. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though its EPSS of 0.76% places it at the 73rd percentile, suggesting elevated machine-learning-derived risk relative to the broader CVE population.

Technical ContextAI

CWE-532 (Insertion of Sensitive Information into Log File) describes a class of flaw where an application records sensitive runtime data - such as credentials, session tokens, API keys, or personally identifiable information - into log output. In the WordPress ecosystem, plugins often write debug or activity logs to files within the webroot (e.g., under wp-content/uploads/ or the plugin directory), making those files directly reachable via HTTP without any authentication challenge. The affected product is cpe:2.3:a:wpkube:subscribe_to_comments_reloaded:*:*:*:*:*:wordpress:*:* covering all versions through 220725. The version string follows a YYYYMMDD convention, placing the last known vulnerable release at 2022-07-25.

RemediationAI

Patch available per vendor advisory - update Subscribe To Comments Reloaded to any version released after 220725 from the WordPress Plugin Repository. The exact patched version number is not confirmed in the available input data and should be verified against the Patchstack advisory at https://patchstack.com/database/vulnerability/subscribe-to-comments-reloaded/wordpress-subscribe-to-comments-reloaded-plugin-220725-sensitive-data-exposure-vulnerability before deployment. As an interim workaround, administrators should locate any log files created by the plugin (typically within wp-content/plugins/subscribe-to-comments-reloaded/ or wp-content/uploads/) and either delete them or restrict direct HTTP access via web server rules (e.g., deny all access to *.log files in .htaccess or nginx location blocks). Note that blocking HTTP access does not eliminate sensitive data written to logs - it only prevents unauthenticated retrieval; the underlying logging behavior should be remediated by patching.