# Video Comments Webcam Recorder <= 2.1.11 - Authenticated (Subscriber+) Missing Authorization to Recording Upload via vw_irec_app AJAX Action

- **ID:** WPSEC-2026-2429
- **Plugin:** Webcam/Screen/Mic Recorder for Video Comments and Forms (`video-comments-webcam-recorder`), https://wordpress.org/plugins/video-comments-webcam-recorder/
- **Affected versions:** from 2.1.1 before 2.3.3
- **Fixed in:** 2.3.3 (Update to 2.3.3 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/video-comments-webcam-recorder
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2429/

## Description

The Webcam/Screen/Mic Recorder for Video Comments and Forms plugin for WordPress is vulnerable to unauthorized access via the vw_irec_app AJAX action in all versions up to, and including, 2.1.11, due to a missing authorization check and missing nonce validation in the vw_irec_app() handler. The handler does not enforce the 'Who can record videos' setting (such as 'Members in List'), which is only checked when the recorder shortcode is rendered. This makes it possible for authenticated attackers with Subscriber-level access and above to upload media files with allowed extensions (mp3, ogg, opus, mp4, webm) to the recordings directory, and to create Media Library attachments or Video Share VOD imports when those integrations are enabled, even when they are not allowed to record.

## References

- https://wpsec.com/vuln/WPSEC-2026-2429/
- https://plugins.svn.wordpress.org/video-comments-webcam-recorder/tags/2.3.3/
- https://wordpress.org/plugins/video-comments-webcam-recorder/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2429/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.