Local File Inclusion Vulnerability in Subscribe to Comments Plugin by WordPress

CVE-2015-10133

What is CVE-2015-10133?

The Subscribe to Comments plugin for WordPress is susceptible to Local File Inclusion (LFI) in versions up to and including 2.1.2. This vulnerability arises from the improper handling of the Path to header value, granting authenticated users with administrative privileges the ability to include and execute arbitrary files from the server. By exploiting this flaw, attackers can potentially bypass access controls and execute arbitrary PHP code, leading to data exposure or further system compromise through malicious file inclusion. The risk increases when the function is misused to upload and include files that should be considered safe.

References