Subscribe To Comments Reloaded CVE-2026-4409

The vulnerability is exploitable against any WordPress site with Subscribe To Comments Reloaded plugin version 240119 or earlier running in default configuration. The global secret key must be accessible from public post pages (no authentication barrier). The attacker must be able to extract or view the key from page source or HTTP responses. No special plugin configuration is required to enable the vulnerability-it exists in the default behavior. The subscription management endpoint must accept the forged tokens without additional validation (e.g., server-side rate limiting or email confirmation). Exploitation is limited by the absence of direct user interaction (victim does not need to click a link or authenticate), but relies on the attacker's ability to enumerate or predict target user email addresses or subscription records. Non-vulnerable scenarios: sites with the plugin disabled, sites using a Web Application Firewall blocking forged token patterns, sites running a patched version post-240119.

CVSS 6.5 (network vector, low complexity, no privileges required, no user interaction) indicates a readily exploitable vulnerability affecting the confidentiality and integrity of subscription data. The attack complexity is low because the secret key is leaked on public pages-no sophisticated analysis required. The scope is unchanged (impact limited to subscription data within the affected application). EPSS score not provided in input, but given the public nature of the vulnerability details (code references available in WordPress plugin repository), real-world exploitation is probable. The vulnerability does not directly enable remote code execution or denial of service; impact is limited to unauthorized subscription preference manipulation and potential information disclosure (account enumeration via subscription status). However, the trivial exploitation conditions (unauthenticated, network-accessible, no user interaction) and the public availability of vulnerable code references suggest this will be actively exploited once patch status is known. Risk is amplified by the broad user base of WordPress plugins and the common deployment of this plugin on thousands of sites.

An attacker navigates to any public blog post on a WordPress site using Subscribe To Comments Reloaded and extracts the global secret key by parsing the page HTML or JavaScript. Using the weak hash algorithm, the attacker forges a valid subscription token for any known email address or user account. The attacker then submits a request to the plugin's subscription management endpoint with the forged token, unsubscribing a legitimate user from comments or modifying their notification preferences. The attacker repeats this for multiple users to disrupt their engagement or conduct account enumeration.