CVE-2026-24554

Vulnerability

Cross-Site Request Forgery (CSRF) vulnerability exists in the WPSubscription plugin by Convers Lab, affecting versions from n/a through 1.9.1 [1]. The vulnerability allows an attacker to craft requests that can be executed by a privileged user without their consent.

Exploitation

An attacker can exploit this by tricking a logged-in administrator into clicking a malicious link or visiting a crafted page while authenticated [1]. No special network position is required; user interaction is necessary.

Impact

Successful exploitation enables an attacker to force the victim to perform unwanted actions under their current authentication, such as changing plugin settings or deleting subscription data [1]. This compromises the integrity and availability of the site.

Mitigation

Update the WPSubscription plugin to version 1.9.2 or later [1]. Patchstack users can enable auto-updates for vulnerable plugins. If unable to update, contact your hosting provider for assistance.