Subscribe To Comments Reloaded WordPress Plugin Improper Authorization Vulnerability Allowing Unauthenticated Subscription Management

A vulnerability exists in the Subscribe To Comments Reloaded WordPress plugin, in all versions up to and including 240119. The issue stems from a leaked secret key and the use of a weak hash generation algorithm, which together allow unauthenticated attackers to manipulate comment subscription preferences for any user. Exploitation involves extracting the global key from a public post page, forging authorization keys, and then using these to manage subscription settings.

Impact

Exploitation of this vulnerability allows for unauthorized changes to comment subscription preferences, potentially leading to misuse of the subscription management features of the plugin.

Reproduction

The vulnerability can be reproduced by accessing a public post page with the Subscribe To Comments Reloaded plugin active. The global key can be extracted from the page, and then used to forge authorization keys. With the forged keys, subscription preferences can be managed for any user.

Remediation

No known patch is available. It is recommended to uninstall the affected plugin and find a replacement.