WebinarPress <= 1.33.30 - Unauthenticated Missing Authorization to Multiple AJAX Actions
- ID
- WPSEC-2026-0546
- Plugin
- WebinarPress – Webinar System for WordPress (wp-webinarsystem)
- Affected
- from 1.30 before 1.33.31
- Remediation
- Update to 1.33.31 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-07
- Attack surface
- WebinarPress on WPSec AttackSurface
- Fix released
- Published
Description
The WebinarPress plugin for WordPress is vulnerable to unauthorized modification and access of data in versions 1.30 up to, and including, 1.33.30 due to missing capability checks on several AJAX actions registered for unauthenticated users (unraise-hands, show-cta, action-box-status, set_hand_raising_enabled and get-drip-campaigns), which were protected only by a nonce exposed to all visitors on public webinar pages or by no check at all. This makes it possible for unauthenticated attackers to lower all raised attendee hands, show or hide a webinar's call-to-action and action box, enable or disable hand raising on any webinar, and list Drip campaigns using the site's stored Drip API key.
References
- https://wpsec.com/vuln/WPSEC-2026-0546/
- https://plugins.svn.wordpress.org/wp-webinarsystem/tags/1.33.31/
- https://wordpress.org/plugins/wp-webinarsystem/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS