The vulnerability CVE-2026-24522 affects the WP Subscribe plugin by MyThemeShop, specifically versions up to and including 1.2.16. It is a missing authorization vulnerability where access control is incorrectly configured, allowing users with limited privileges to perform unauthorized actions. The CVSS score is 4.3 (medium severity) with the vector indicating network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

An attacker with low privileges can exploit this missing authorization to perform unauthorized actions that affect data integrity within the WP Subscribe plugin. There is no impact on confidentiality or availability. No known exploits have been reported, limiting immediate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user privileges to the minimum necessary and monitor for unusual activity related to the WP Subscribe plugin. Avoid granting unnecessary permissions to users who can interact with this plugin.