WordPress Plugin Vulnerabilities

Subscribe2 < 10.45 - Missing Authorization

Description

The Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 10.44. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
subscribe2
Fixed in 10.45

References

CVE
CVE-2026-24944
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/38bf5451-5042-48ad-a189-699e1e7abf07

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
blue0x1
Verified
No
WPVDB ID
d4c000cb-08df-4854-abc4-b84bd2c33625

Timeline

Publicly Published
2026-02-03 (about 6 months ago)
Added
2026-02-09 (about 6 months ago)
Last Updated
2026-02-09 (about 6 months ago)

Other

Published
Title
Published
2026-01-14
Title
Raptive Ads <= 3.10.0 - Missing Authorization
Published
2024-02-14
Title
EventPrime – Events Calendar, Bookings and Tickets < 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Event Export
Published
2025-06-18
Title
Breeze < 2.2.14 - Missing Authorization
Published
2026-02-19
Title
Nanosoft < 1.3.2 - Missing Authorization
Published
2026-01-09
Title
Proxy & VPN Blocker < 3.5.4 - Missing Authorization