{
 "id": "WPSEC-2026-0545",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0545/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0545/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0545/index.md",
 "title": "WebinarPress <= 1.33.30 - Authenticated (Subscriber+) Missing Authorization to Multiple Administrative Actions",
 "description": "The WebinarPress plugin for WordPress is vulnerable to unauthorized access and modification of data in all versions up to, and including, 1.33.30 due to missing capability checks on several administrative AJAX and admin actions, including the webinar parameter, webinar list, registration widget, page lookup, AWeber revocation and webinar duplication actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the full settings of any webinar, including drafts, such as its access password and live stream URL, list draft and private webinars and the titles of non-public posts, disconnect the site's AWeber integration, and create draft copies of arbitrary posts.",
 "plugin": {
  "slug": "wp-webinarsystem",
  "name": "WebinarPress",
  "full_name": "WebinarPress – Webinar System for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/wp-webinarsystem/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-webinarsystem/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-webinarsystem"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.33.31",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.33.31"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.33.31",
 "remediation": "Update to 1.33.31 or later.",
 "fix_released": "2026-10-06T05:01:27+00:00",
 "published": "2026-10-07T14:47:02+00:00",
 "updated": "2026-10-07T13:54:54.861364+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0545/",
  "https://plugins.svn.wordpress.org/wp-webinarsystem/tags/1.33.31/",
  "https://wordpress.org/plugins/wp-webinarsystem/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-webinarsystem",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-07"
 }
}