CVE-2026-91830
Received Received - Intake

Subscribe to Comments Plugin Authentication Bypass

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: WPScan

Description
The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-91830
EUVD
EUVD-2026-102684

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Subscribe to Comments 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Subscribe to Comments WordPress plugin before version 2.3.3 has a flaw where it does not properly validate or sign a cookie used to identify commenters. This allows unauthenticated attackers to forge these cookies, disclose a subscriber's management key, and silently change their subscription settings without needing authentication.

Detection Guidance

Check the installed version of the Subscribe to Comments WordPress plugin. If it is below 2.3.3, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details.

Impact Analysis

An attacker could exploit this to access a subscriber's management key, view their subscription details, and modify them without permission. This could lead to unauthorized changes in notifications or exposure of private information tied to the subscriber's account.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of user data, potentially violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Non-compliance risks fines or legal consequences.

Mitigation Strategies

Update the Subscribe to Comments plugin to version 2.3.3 or later immediately. If updating is not possible, consider disabling the plugin temporarily until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91830. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart