Live › vulnerability › CVE-2026-91830
Go to dashboardThe Subscribe to Comments WordPress plugin before 2.3.3 trusts an unsigned, unvalidated cookie to identify a commenter. An unauthenticated attacker can forge that cookie to read a subscriber's management key and change that subscriber's comment subscriptions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Subscribe to Comments WordPress plugin before that let visitors subscribe to comment notifications are exposed. Sites without the plugin, or with it at or later, are not affected. Sources do not say whether non-default configuration changes exposure.
2.3.32.3.3No product ranges from the sources yet.
wp-content/plugins/ (version in the plugin header)2.3.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions.
This page as .md · .json · in your agent: get_signal("CVE-2026-91830")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.