CVE-2026-91830

3th percentile - higher than 3% of all known CVEs

The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions.

An attacker can take control of users' subscriptions without authentication, disclosing the management key and modifying subscriptions without the victim's knowledge.

Update the Subscribe to Comments plugin to version 2.3.3 or later.