WebinarPress <= 1.33.30 - Authenticated (Subscriber+) Missing Authorization to Multiple Administrative Actions
- ID
- WPSEC-2026-0545
- Plugin
- WebinarPress – Webinar System for WordPress (wp-webinarsystem)
- Affected
- all versions before 1.33.31
- Remediation
- Update to 1.33.31 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-07
- Attack surface
- WebinarPress on WPSec AttackSurface
- Fix released
- Published
Description
The WebinarPress plugin for WordPress is vulnerable to unauthorized access and modification of data in all versions up to, and including, 1.33.30 due to missing capability checks on several administrative AJAX and admin actions, including the webinar parameter, webinar list, registration widget, page lookup, AWeber revocation and webinar duplication actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the full settings of any webinar, including drafts, such as its access password and live stream URL, list draft and private webinars and the titles of non-public posts, disconnect the site's AWeber integration, and create draft copies of arbitrary posts.
References
- https://wpsec.com/vuln/WPSEC-2026-0545/
- https://plugins.svn.wordpress.org/wp-webinarsystem/tags/1.33.31/
- https://wordpress.org/plugins/wp-webinarsystem/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS