# WebinarPress <= 1.33.30 - Authenticated (Subscriber+) Missing Authorization to Multiple Administrative Actions

- **ID:** WPSEC-2026-0545
- **Plugin:** WebinarPress – Webinar System for WordPress (`wp-webinarsystem`), https://wordpress.org/plugins/wp-webinarsystem/
- **Affected versions:** all versions before 1.33.31
- **Fixed in:** 1.33.31 (Update to 1.33.31 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-webinarsystem
- **Fix released:** 2026-10-06
- **Published:** 2026-10-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0545/

## Description

The WebinarPress plugin for WordPress is vulnerable to unauthorized access and modification of data in all versions up to, and including, 1.33.30 due to missing capability checks on several administrative AJAX and admin actions, including the webinar parameter, webinar list, registration widget, page lookup, AWeber revocation and webinar duplication actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the full settings of any webinar, including drafts, such as its access password and live stream URL, list draft and private webinars and the titles of non-public posts, disconnect the site's AWeber integration, and create draft copies of arbitrary posts.

## References

- https://wpsec.com/vuln/WPSEC-2026-0545/
- https://plugins.svn.wordpress.org/wp-webinarsystem/tags/1.33.31/
- https://wordpress.org/plugins/wp-webinarsystem/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0545/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.