{
 "id": "WPSEC-2026-0755",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0755/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0755/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0755/index.md",
 "title": "Video Conferencing with BigBlueButton (BBB) <= 3.2.16 - Unauthenticated Missing Authorization to Recording Exposure via Fluent Community Lesson Recordings Shortcode",
 "description": "The Virtual Classroom & Video Conferencing – BigBlueButton plugin for WordPress is vulnerable to unauthorized access of room recordings via the recordings shortcode rendered in Fluent Community course lessons in versions 3.2.16 up to, and including, 3.2.16. This is due to a missing authorization check in the course portal rendering path (portal_view_from_tokens_string). That path lists the recordings of every room named in the shortcode without the room-recording permission check that the regular recordings view applies. This makes it possible for unauthenticated attackers to view recording names and playback links for rooms that normally require an access code. The site must have Fluent Community configured with a public portal and public lesson viewing, and a lesson must contain a BigBlueButton recordings shortcode.",
 "plugin": {
  "slug": "video-conferencing-with-bbb",
  "name": "Video Conferencing with BigBlueButton (BBB)",
  "full_name": "Virtual Classroom & Video Conferencing – BigBlueButton",
  "wordpress_org": "https://wordpress.org/plugins/video-conferencing-with-bbb/",
  "advisories_url": "https://wpsec.com/vuln/plugin/video-conferencing-with-bbb/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/video-conferencing-with-bbb"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.2.16",
    "from_inclusive": true,
    "to": "3.2.17",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.2.16 before 3.2.17"
  ]
 },
 "introduced_in": "3.2.16",
 "fixed_in": "3.2.17",
 "remediation": "Update to 3.2.17 or later.",
 "fix_released": "2026-10-09T11:26:37+00:00",
 "published": "2026-10-10T15:41:27+00:00",
 "updated": "2026-10-10T14:54:11.112599+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0755/",
  "https://plugins.svn.wordpress.org/video-conferencing-with-bbb/tags/3.2.17/",
  "https://wordpress.org/plugins/video-conferencing-with-bbb/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/video-conferencing-with-bbb",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-10"
 }
}