The “Subscribe to Comments for WordPress” plugin is a popular tool that allows website visitors to receive email notifications when new comments are posted on articles they’ve engaged with. However, a significant security flaw, identified as CVE-2015-10133, was discovered in versions up to and including 2.1.2. This vulnerability could allow an attacker to gain control over your website.<\/p>\n
Specifically, the plugin was vulnerable to what’s known as Local File Inclusion (LFI) through a part of its code that handles the “Path to header” value. This means an authenticated attacker, particularly one with administrative privileges, could trick the plugin into opening and running files already present on your server. If they could also upload other file types, like images containing malicious PHP code, they could then execute that code, potentially taking full control of your site, stealing sensitive data, or bypassing security measures.<\/p>\n
Product:<\/strong> Subscribe to Comments for WordPress<\/p>\n CVE ID:<\/strong> CVE-2015-10133<\/p>\n Published:<\/strong> July 19, 2025<\/p>\n Severity:<\/strong> High<\/p>\n Status:<\/strong> Analyzed<\/p>\n The vulnerability impacts the “Subscribe to Comments for WordPress” plugin in all versions up to, and including, 2.1.2. If you are running any version within this range, your WordPress site could be at risk.<\/p>\n This vulnerability has been thoroughly analyzed. Details regarding the flaw and its potential impact are publicly available, allowing administrators to understand the risks and take appropriate action.<\/p>\n Rated as HIGH severity with a CVSS score of 7.2, this vulnerability poses a serious threat. A successful exploit could lead to full system compromise, allowing attackers to execute arbitrary code, steal sensitive information, or even deface your website. The risk is particularly high because it allows for arbitrary PHP code execution, which grants extensive control over the affected server.<\/p>\n The good news is that this vulnerability has been fixed. To secure your WordPress site, it is crucial to update your “Subscribe to Comments” plugin immediately. The issue was resolved in version 2.3 and later.<\/p>\n For more general security advice, consider reviewing your WordPress Security Best Practices<\/a> and learning more about Understanding Local File Inclusion<\/a> to protect against similar threats.<\/p>\n https:\/\/advisories.dxw.com\/advisories\/admin-only-local-file-inclusion-and-arbitrary-code-execution-in-subscribe-to-comments-2-1-2\/ The “Subscribe to Comments for WordPress” plugin is a popular tool that allows website visitors to receive email notifications when new comments are posted on articles they’ve engaged with. However, a significant security flaw, identified as CVE-2015-10133, was discovered in versions up to and including 2.1.2. This vulnerability could allow an attacker to gain control […]<\/p>\n","protected":false},"author":17,"featured_media":2545,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[890,885,715,889,726],"class_list":["post-3006","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-arbitrary-code-execution","tag-local-file-inclusion","tag-plugin-vulnerability","tag-subscribe-to-comments","tag-wordpress"],"blocksy_meta":[],"yoast_head":"\nAffected Products<\/h2>\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
References<\/h2>\n
\nhttps:\/\/packetstormsecurity.com\/files\/132694\/
\nhttps:\/\/plugins.trac.wordpress.org\/changeset?sfp_email=&sfph_mail=&reponame=&old=1198281%40subscribe-to-comments&new=1198281%40subscribe-to-comments&sfp_email=&sfph_mail=
\nhttps:\/\/seclists.org\/fulldisclosure\/2015\/Jul\/71
\nhttps:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/f92784a7-f2b3-47f8-b03f-4e234b57e40a?source=cve<\/p>\n","protected":false},"excerpt":{"rendered":"