The Subscribe To Comments Reloaded plugin for WordPress suffers from an improper authorization flaw due to a leaked secret key and a weak hash generation algorithm present in all releases up to 240119. This vulnerability allows an attacker who does not have authentication credentials to obtain the global key from a public post page. With that key, the attacker can forge authorization tokens and modify comment subscription preferences for any user. The impact is the unauthorized alteration of subscription settings, potentially causing unwanted notifications or denial of service to subscription functionality.

WordPress sites using the wpkube:Subscribe To Comments Reloaded plugin with any version dated 240119 or earlier are affected. The plugin must be upgraded to a version released after 240119 to eliminate the flaw.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves unauthenticated access to publicly exposed post pages to extract the leaked key, after which an attacker can forge keys and manipulate subscription records. Because no authentication is required, any visitor can exploit the flaw if the plugin remains at a vulnerable version.