CVE-2015-10133: The Subscribe to Comments for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.1.2 via the Path to header value. This allows authenticated attackers, with administra

high Affects subscribe-to-comments (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2025-07-19; advisory modified 2026-06-17.

The Subscribe to Comments for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.1.2 via the Path to header value. This allows authenticated attackers, with administra

Package: subscribe-to-comments (WordPress plugin) WordPress
Affected versions: <=2.1.2
Fixed in: no fix recorded
Severity: high CVSS 7.2
Exploitation: not on CISA KEV · EPSS 2% (84.1th percentile)
Published: 2025-07-19
Source: nvd

References

CWE-98

NVD record subscribe-to-comments (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2006-10001 low A vulnerability, which was classified as problematic, was found in Subscribe to Comments P same package: subscribe-to-comments (WordPress plugin)
CVE-2024-8792 medium The Subscribe to Comments plugin for WordPress is vulnerable to Reflected Cross-Site Scrip same package: subscribe-to-comments (WordPress plugin)
CVE-2023-2249 high The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Req same weakness: CWE-98
CVE-2023-6989 critical The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPr same weakness: CWE-98
CVE-2025-4380 high The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is v same weakness: CWE-98
CVE-2020-5295 medium Local File read vulnerability in OctoberCMS same weakness: CWE-98