Subscribe to Comments EUVD-2026-102684

Exploitation requires the target WordPress site to run the Subscribe to Comments plugin at a version before 2.3.3, and requires the existence of a victim who has subscribed to comment threads (the management key and subscription data only exist for actual subscribers). The core enabling condition is the plugin's design flaw: it trusts a commenter-identifying cookie that is neither signed nor validated, so an attacker can forge or replay it to impersonate a subscriber without authentication (PR:N) or user interaction (UI:N). Limiting factors: impact is scoped per targeted subscriber (one key / one subscription set at a time, C:L/I:L) rather than site-wide, there is no availability or code-execution impact (A:N), and the attacker benefits from knowing or guessing which subscriber (e.g., which email/identity) to impersonate to obtain a specific key.

This is a medium-severity information-disclosure and data-tampering flaw (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) that is remotely reachable with no authentication or user interaction, which raises its reachability profile. However, the real-world risk signals point toward a modest priority rather than an emergency: EPSS is only 0.14% (3rd percentile), it is NOT listed in CISA KEV, and there is no evidence of active exploitation. Publicly available exploit code exists (WPScan), so weaponization barriers are low, but POC availability is a distinct signal from in-the-wild use and should not be conflated with it. The impact is also bounded - C:L/I:L/A:N means limited confidentiality loss (a per-subscriber management key) and limited integrity impact (altering one subscriber's subscription settings), not full site compromise, code execution, or administrator takeover. No SSVC decision data was provided in the input. Net: a legitimate patch-worthy issue driven by easy, unauthenticated access and public POC, but the limited and per-victim scope plus very low EPSS and absence of KEV suggest it is not a widespread-exploitation priority - schedule the update rather than treating it as a fire drill.

A remote, unauthenticated attacker forges the cookie that the Subscribe to Comments plugin trusts (unsigned and unvalidated) to impersonate a chosen commenter/subscriber. Because the cookie is trusted without a signature check, the attacker retrieves that subscriber's management key and can silently change their subscription settings. A public exploit for this is available via WPScan, lowering the skill required.