CVE-2026-91830

The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions...

CVE-2026-91830

The Subscribe to Comments WordPress plugin, in versions prior to 2.3.3 , is vulnerable to an unauthenticated Subscription Management Key Disclosure . The root cause is that the plugin fails to sign or validate a cookie used to identify a commenter. This allows an unauthenticated attacker to discl...

CVE-2026-91830 Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment Cookie

The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions...