{
 "id": "WPSEC-2026-2429",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2429/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2429/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2429/index.md",
 "title": "Video Comments Webcam Recorder <= 2.1.11 - Authenticated (Subscriber+) Missing Authorization to Recording Upload via vw_irec_app AJAX Action",
 "description": "The Webcam/Screen/Mic Recorder for Video Comments and Forms plugin for WordPress is vulnerable to unauthorized access via the vw_irec_app AJAX action in all versions up to, and including, 2.1.11, due to a missing authorization check and missing nonce validation in the vw_irec_app() handler. The handler does not enforce the 'Who can record videos' setting (such as 'Members in List'), which is only checked when the recorder shortcode is rendered. This makes it possible for authenticated attackers with Subscriber-level access and above to upload media files with allowed extensions (mp3, ogg, opus, mp4, webm) to the recordings directory, and to create Media Library attachments or Video Share VOD imports when those integrations are enabled, even when they are not allowed to record.",
 "plugin": {
  "slug": "video-comments-webcam-recorder",
  "name": "Video Comments Webcam Recorder",
  "full_name": "Webcam/Screen/Mic Recorder for Video Comments and Forms",
  "wordpress_org": "https://wordpress.org/plugins/video-comments-webcam-recorder/",
  "advisories_url": "https://wpsec.com/vuln/plugin/video-comments-webcam-recorder/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/video-comments-webcam-recorder"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.1.1",
    "from_inclusive": true,
    "to": "2.3.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.1.1 before 2.3.3"
  ]
 },
 "introduced_in": "2.1.1",
 "fixed_in": "2.3.3",
 "remediation": "Update to 2.3.3 or later.",
 "fix_released": "2026-11-02T20:10:48+00:00",
 "published": "2026-11-03T20:40:54+00:00",
 "updated": "2026-11-03T13:23:44.333073+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2429/",
  "https://plugins.svn.wordpress.org/video-comments-webcam-recorder/tags/2.3.3/",
  "https://wordpress.org/plugins/video-comments-webcam-recorder/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/video-comments-webcam-recorder",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-04"
 }
}