What is the CVSS score of CVE-2026-4409?

CVE-2026-4409 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Subscribe To Comments Reloaded CVE-2026-4409

EUVD-2026-27180 MEDIUM

Information Exposure (CWE-200)

2026-05-05 Wordfence

GHSA-gwh7-h25p-fjxv

Information Disclosure WordPress

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 03:30 vuln.today

DescriptionCVE.org

The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a leaked secret key and usage of a weak hash generation algorithm in all versions up to, and including, 240119. This makes it possible for unauthenticated attackers to extract the global key from any public post page, forge authorization keys and manage comment subscription preferences for arbitrary users

AnalysisAI

Subscribe To Comments Reloaded plugin for WordPress up to version 240119 allows unauthenticated attackers to extract a global secret key from public post pages and forge authorization tokens, enabling unauthorized modification of comment subscription preferences for arbitrary users. The vulnerability stems from weak hash generation and key exposure, affecting all installations without authentication requirements. Active exploitation potential is high given the trivial access vector (network, no user interaction) and the ability to manipulate user subscription data.

Technical ContextAI

The plugin implements a subscription management system that relies on cryptographic tokens to authenticate users managing their subscription preferences. The vulnerability exists in the token generation and validation mechanism, where a hardcoded or easily-extractable global secret key is exposed on public-facing post pages. The plugin uses a weak hash algorithm (likely insufficient entropy or predictable values) to derive authorization keys from this leaked secret, allowing attackers to cryptographically forge valid subscription tokens without knowing individual user credentials. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) indicates the root cause is improper protection of the secret key material. The affected CPE indicates all versions of the wpkube Subscribe To Comments Reloaded plugin through 240119 contain this flaw.

RemediationAI

Update the Subscribe To Comments Reloaded plugin immediately to a patched version released after January 19, 2024 (version 240119 is confirmed vulnerable). Deactivate and remove the plugin if an update is not yet available from the developer. As a temporary compensating control, restrict access to post pages containing subscription management forms using a Web Application Firewall (WAF) rule that blocks requests containing token-forging patterns or limits access to logged-in users only; note that this reduces plugin functionality. Administrators should audit user subscription changes in the plugin logs (if available) to identify potential unauthorized modifications during the exposure window. Monitor the official WordPress plugin repository and Wordfence intelligence for patch release announcements.