Threats tagged 'ghsa-gwh7-h25p-fjxv'

The Subscribe To Comments Reloaded WordPress plugin has a vulnerability in all versions up to and including 240119 that allows unauthorized modification of comment subscription data. This is due to a leaked secret key and the use of a weak hash generation algorithm, enabling unauthenticated attackers to extract the global key from any public post page and forge authorization keys to manage subscription preferences for arbitrary users.