Video Comments Webcam Recorder <= 2.1.11 - Authenticated (Subscriber+) Missing Authorization to Recording Upload via vw_irec_app AJAX Action
- ID
- WPSEC-2026-2429
- Plugin
- Webcam/Screen/Mic Recorder for Video Comments and Forms (video-comments-webcam-recorder)
- Affected
- from 2.1.1 before 2.3.3
- Remediation
- Update to 2.3.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-04
- Attack surface
- Video Comments Webcam Recorder on WPSec AttackSurface
- Fix released
- Published
Description
The Webcam/Screen/Mic Recorder for Video Comments and Forms plugin for WordPress is vulnerable to unauthorized access via the vw_irec_app AJAX action in all versions up to, and including, 2.1.11, due to a missing authorization check and missing nonce validation in the vw_irec_app() handler. The handler does not enforce the 'Who can record videos' setting (such as 'Members in List'), which is only checked when the recorder shortcode is rendered. This makes it possible for authenticated attackers with Subscriber-level access and above to upload media files with allowed extensions (mp3, ogg, opus, mp4, webm) to the recordings directory, and to create Media Library attachments or Video Share VOD imports when those integrations are enabled, even when they are not allowed to record.
References
- https://wpsec.com/vuln/WPSEC-2026-2429/
- https://plugins.svn.wordpress.org/video-comments-webcam-recorder/tags/2.3.3/
- https://wordpress.org/plugins/video-comments-webcam-recorder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS