Subscribe To Comments Reloaded
Monthly
Subscribe To Comments Reloaded plugin for WordPress up to version 240119 allows unauthenticated attackers to extract a global secret key from public post pages and forge authorization tokens, enabling unauthorized modification of comment subscription preferences for arbitrary users. The vulnerability stems from weak hash generation and key exposure, affecting all installations without authentication requirements. Active exploitation potential is high given the trivial access vector (network, no user interaction) and the ability to manipulate user subscription data.
Sensitive data exposure in the Subscribe To Comments Reloaded WordPress plugin (versions through 220725) allows unauthenticated remote attackers to retrieve information written to application log files. The plugin inserts sensitive data - likely subscriber email addresses, tokens, or configuration values - into log files that appear to be accessible without authentication, based on the PR:N/AV:N CVSS vector assigned by Patchstack. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though its EPSS of 0.76% places it at the 73rd percentile, suggesting elevated machine-learning-derived risk relative to the broader CVE population.
Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 211130 on WordPress allows attackers to clean up Log archive, download system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Subscribe To Comments Reloaded plugin for WordPress up to version 240119 allows unauthenticated attackers to extract a global secret key from public post pages and forge authorization tokens, enabling unauthorized modification of comment subscription preferences for arbitrary users. The vulnerability stems from weak hash generation and key exposure, affecting all installations without authentication requirements. Active exploitation potential is high given the trivial access vector (network, no user interaction) and the ability to manipulate user subscription data.
Sensitive data exposure in the Subscribe To Comments Reloaded WordPress plugin (versions through 220725) allows unauthenticated remote attackers to retrieve information written to application log files. The plugin inserts sensitive data - likely subscriber email addresses, tokens, or configuration values - into log files that appear to be accessible without authentication, based on the PR:N/AV:N CVSS vector assigned by Patchstack. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though its EPSS of 0.76% places it at the 73rd percentile, suggesting elevated machine-learning-derived risk relative to the broader CVE population.
Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 211130 on WordPress allows attackers to clean up Log archive, download system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.