Access Control Flaw in weDevs Subscribe2 Plugin by WordPress
CVE-2026-24944

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Subscribe2
Vendor
CVE Published:
20 February 2026

What is CVE-2026-24944?

A vulnerability in the weDevs Subscribe2 plugin allows attackers to exploit incorrectly configured access control settings. This issue could lead to unauthorized access, enabling malicious actors to manipulate or view content they shouldn't be able to. Security levels within the plugin are not adequately enforced, making it essential for users to review and adjust their settings to prevent potential exploitation. This vulnerability affects Subscribe2 versions n/a through 10.44, necessitating prompt attention from site administrators.

Affected Version(s)

Subscribe2 0 <= 10.44

References

https://patchstack.com/database/Wordpress/Plugin/subscrib...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

chokri hammedi | Patchstack Bug Bounty Program
.