PT-2025-30125 · WordPress · Subscribe To Comments For Wordpress

Published 2025-07-19 · Updated 2025-07-19 · CVE-2015-10133

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Subscribe to Comments for WordPress versions prior to 2.1.3

Description The Subscribe to Comments for WordPress is susceptible to a Local File Inclusion issue via the Path to header value. Authenticated attackers with administrative privileges and above can include and execute arbitrary files on the server, potentially leading to bypass of access controls, sensitive data exposure, or code execution if images or other file types can be uploaded and included. This functionality can also be used to execute arbitrary PHP code.

Recommendations Update Subscribe to Comments for WordPress to version 2.1.3 or later.

Exploit

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2015-10133

Affected Products

Subscribe To Comments For Wordpress

References · 8

• 🔥 https://packetstormsecurity.com/files/132694 · Exploit
• 🔥 https://advisories.dxw.com/advisories/admin-only-local-file-inclusion-and-arbitrary-code-execution-in-subscribe-to-comments-2-1-2 · Exploit
• 🔥 https://seclists.org/fulldisclosure/2015/Jul/71 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-10133 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1198281%40subscribe-to-comments&new=1198281%40subscribe-to-comments&sfp_email=&sfph_mail= · Note
• https://t.me/cvenotify/129539 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/f92784a7-f2b3-47f8-b03f-4e234b57e40a?source=cve · Note
• https://t.me/cvetracker/28201 · Telegram Post