6.5 Medium

CVE-2026-4409 The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a…

Description

The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a leaked secret key and usage of a weak hash generation algorithm in all versions up to, and including, 240119. This makes it possible for unauthenticated attackers to extract the global key from any public post page, forge authorization keys and manage comment subscription preferences for arbitrary users

Affected products and versions

Product	Affected versions	Fixed in
Subscribe To Comments Reloaded 240119	earliest → 240119	No fix stated

The 2 CVEs of Subscribe To Comments Reloaded →

CVE-2024-31249 Insertion of Sensitive Information into Log File vulnerability in WPKube Subscribe To Comments Reloaded.This issue… 5.3 Medium

Do you use Subscribe To Comments Reloaded?

Track this CVE Watch Subscribe To Comments Reloaded Check my SBOMs

www.cveye.io/en/cve/CVE-2026-4409

Timeline

Published May 5, 2026
Last modified May 5, 2026

References

www.wordfence.com www.wordfence.com
plugins.trac.wordpress.org plugins.trac.wordpress.org
plugins.trac.wordpress.org plugins.trac.wordpress.org
plugins.trac.wordpress.org plugins.trac.wordpress.org

Track this CVE

CVE-2026-4409 The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a…

Description

Affected products and versions

Other CVEs of Subscribe To Comments Reloaded