# WebinarPress <= 1.33.30 - Unauthenticated Missing Authorization to Multiple AJAX Actions

- **ID:** WPSEC-2026-0546
- **Plugin:** WebinarPress – Webinar System for WordPress (`wp-webinarsystem`), https://wordpress.org/plugins/wp-webinarsystem/
- **Affected versions:** from 1.30 before 1.33.31
- **Fixed in:** 1.33.31 (Update to 1.33.31 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-webinarsystem
- **Fix released:** 2026-10-06
- **Published:** 2026-10-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0546/

## Description

The WebinarPress plugin for WordPress is vulnerable to unauthorized modification and access of data in versions 1.30 up to, and including, 1.33.30 due to missing capability checks on several AJAX actions registered for unauthenticated users (unraise-hands, show-cta, action-box-status, set_hand_raising_enabled and get-drip-campaigns), which were protected only by a nonce exposed to all visitors on public webinar pages or by no check at all. This makes it possible for unauthenticated attackers to lower all raised attendee hands, show or hide a webinar's call-to-action and action box, enable or disable hand raising on any webinar, and list Drip campaigns using the site's stored Drip API key.

## References

- https://wpsec.com/vuln/WPSEC-2026-0546/
- https://plugins.svn.wordpress.org/wp-webinarsystem/tags/1.33.31/
- https://wordpress.org/plugins/wp-webinarsystem/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0546/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.