PT-2026-36951 · WordPress · Subscribe To Comments Reloaded

Supakiad S · Published 2026-05-05 · Updated 2026-05-21 · CVE-2026-4409

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Subscribe To Comments Reloaded versions prior to 240120

Description The Subscribe To Comments Reloaded plugin for WordPress allows unauthenticated attackers to modify data without authorization. This is caused by a leaked secret key and the use of a weak hash generation algorithm. Attackers can extract the global key from any public post page to forge authorization keys, enabling them to manage comment subscription preferences for arbitrary users.

Recommendations Update the plugin to a version later than 240119.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-4409

Affected Products

Subscribe To Comments Reloaded

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-4409 · Security Note
• https://t.me/cveNotify/162126 · Telegram Post
• https://plugins.trac.wordpress.org/browser/subscribe-to-comments-reloaded/tags/240119/wp_subscribe_reloaded.php#L1613 · Note
• https://reddit.com/r/StopBadBots/comments/1td9gea/critical_warning_these_14_wordpress_plugins · Reddit Post
• https://wordfence.com/threat-intel/vulnerabilities/id/91f9235e-f578-475f-92c3-34062d6d1e3d?source=cve · Note
• https://reddit.com/r/StopBadBots/comments/1tjv1es/critical_warning_62_plugins_2_themes_11_still · Reddit Post
• https://t.me/CVEtracker/52693 · Telegram Post
• https://plugins.trac.wordpress.org/browser/subscribe-to-comments-reloaded/tags/240119/utils/stcr_utils.php#L164 · Note
• https://twitter.com/CVEarity/status/2051576090167300524 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2051618680295796978 · Twitter Post
• https://plugins.trac.wordpress.org/browser/subscribe-to-comments-reloaded/tags/240119/templates/user.php#L37 · Note