CVE-2026-24944: 
WordPress vulnerability analysis and mitigation

CVE-2026-24944 is a Missing Authorization (Broken Access Control) vulnerability in the weDevs Subscribe2 WordPress plugin. It affects all versions through 10.44 and allows unauthenticated remote attackers to exploit incorrectly configured access control security levels. The vulnerability was reported on November 8, 2025, and published on February 20, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack, Feedly).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing privileged actions. An unauthenticated remote attacker can send crafted network requests to trigger functionality that should be restricted to higher-privileged users, exploiting incorrectly configured access control levels. The attack vector is network-based with high attack complexity and requires no user interaction or prior authentication. The vulnerability was discovered by security researcher chokri hammedi and reported to Patchstack (Patchstack).

Successful exploitation can result in high confidentiality impact and low integrity impact, with no availability impact, according to the CVSS scoring. An unauthenticated attacker could access sensitive subscriber data or perform unauthorized actions within the Subscribe2 plugin's functionality on affected WordPress sites. While the scope is limited to the affected system, mass-exploit campaigns targeting thousands of WordPress sites simultaneously are a realistic threat given the nature of this vulnerability class (Patchstack).

No public proof-of-concept exploit code has been identified at this time. The EPSS score is approximately 0.03%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that broken access control vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site traffic or popularity (Patchstack, Feedly).

The vendor has released a patched version: Subscribe2 10.45. Site administrators should update the plugin to version 10.45 or later immediately. Patchstack users benefit from a virtual patch (mitigation rule) that blocks exploitation attempts until the plugin is updated. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance (Patchstack).

Patchstack, which coordinated the disclosure, classified this as a medium-priority vulnerability and issued a virtual mitigation rule for its users. The vulnerability was also covered in the Wordfence Intelligence Weekly WordPress Vulnerability Report for the period of February 2–8, 2026, indicating broad awareness within the WordPress security community (Wordfence, Patchstack).