Subscribe2 CVE-2026-14331

The Subscribe2 WordPress plugin must be installed, active, and at a version earlier than 10.46 on the target site. The plugin's public subscription form must be reachable by unauthenticated users (the default configuration). The attacker requires no authentication on the WordPress site (PR:N per CVSS vector). The critical limiting factor is mandatory victim interaction: the victim must click a specifically crafted URL and load the subscription form page - passive or drive-by exploitation without user action is not possible (UI:R per CVSS vector). Exploitation is further constrained to the victim's browser session; there is no server-side code execution or database access involved. Sites that have restricted subscription form access to authenticated users only, or that have disabled the Subscribe2 frontend form, are not exploitable.

CVSS 6.1 (Medium) is consistent with the attack profile: network-reachable (AV:N), low complexity (AC:L), no attacker privileges (PR:N), but requiring victim interaction (UI:R) and constrained to low confidentiality and integrity impact (C:L/I:L) with no availability impact (A:N). The mandatory UI:R step is the primary real-world friction point - the attacker cannot exploit this passively and must deliver a crafted link via phishing or social engineering. The EPSS score of 0.16% at the 5th percentile corroborates this, suggesting exploitation is unlikely at scale. This is not a CISA KEV-listed vulnerability, so confirmed active exploitation is not established. However, a publicly available POC dramatically lowers the attacker skill bar, and WordPress plugins with wide deployment are frequent phishing campaign targets. Real-world priority is moderate: sites with high subscriber traffic or sensitive admin sessions are at elevated risk from targeted link-delivery attacks.

An attacker identifies a WordPress site running a vulnerable Subscribe2 plugin version and constructs a URL to the public subscription form embedding a JavaScript payload in the vulnerable query parameter. The attacker distributes the link via a phishing email disguised as a newsletter confirmation or subscription invitation, targeting the site's existing subscriber base. When a recipient clicks the link and the form loads, the injected script executes in the victim's browser, allowing the attacker to exfiltrate session cookies, redirect the victim to a credential harvesting page, or silently perform authenticated actions if the victim is logged into WordPress. A public POC is available from WPScan, meaning this requires minimal attacker expertise to weaponize.