The Subscribe to Comments WordPress plugin before version 2.3.3 does not sign or validate a cookie used to identify a commenter, allowing an attacker to forge a cookie that the plugin trusts. This flaw lets an unauthenticated user read a subscriber’s management key and silently change that subscriber’s subscription settings without the subscriber’s knowledge. The disclosed key could be used to impersonate the subscriber or alter their notification preferences, providing both data disclosure and integrity damage.

WordPress sites running the Subscribe to Comments plugin older than 2.3.3 are affected. The plugin is distributed under the name Subscribe to Comments; the vendor is not specified. Anyone who hosts a public WordPress site with a vulnerable plugin instance is at risk.

The vulnerability is exploitable by any internet‑connected WordPress site with a vulnerable plugin version and does not require prior authentication. Based on the description, it is inferred that an attacker could send an HTTP request that sets a forged cookie via a browser or automated script. The EPSS score is 0.00145 (<1%), and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 6.5 indicates a moderate severity. Because the flaw permits both data disclosure and state change, the potential impact on confidentiality and integrity is significant.