CVE-2026-91830: Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment Cookie

Q: Who can exploit this issue?

An unauthenticated attacker can exploit it; no WordPress account or prior authentication is required. The attacker forges the comment cookie that the plugin trusts to identify a commenter.

Q: What impact does successful exploitation have?

An attacker can disclose a subscriber's management key and silently change that subscriber's comment subscription settings.

Q: Which installations are affected?

WordPress sites using Subscribe to Comments versions earlier than 2.3.3 are affected. The provided information does not identify any configuration requirement or workaround.

Published Oct 16, 2026

Updated

The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions.

Affected Software

1 affected component

WordPress Subscribe to Comments<2.3.3

Event History

Oct 16, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated attacker can exploit it; no WordPress account or prior authentication is required. The attacker forges the comment cookie that the plugin trusts to identify a commenter.

What impact does successful exploitation have?

An attacker can disclose a subscriber's management key and silently change that subscriber's comment subscription settings.

Which installations are affected?

WordPress sites using Subscribe to Comments versions earlier than 2.3.3 are affected. The provided information does not identify any configuration requirement or workaround.

CVE-2026-91830: Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment Cookie

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What impact does successful exploitation have?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What impact does successful exploitation have?

Which installations are affected?