Video Comments Webcam Recorder <= 2.3.3 - Unauthenticated Path Traversal via Comment Recording References
- ID
- WPSEC-2026-2434
- Plugin
- Webcam/Screen/Mic Recorder for Video Comments and Forms (video-comments-webcam-recorder)
- Affected
- all versions before 2.3.4
- Remediation
- Update to 2.3.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-22
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-04
- Attack surface
- Video Comments Webcam Recorder on WPSec AttackSurface
- Fix released
- Published
Description
The Webcam/Screen/Mic Recorder for Video Comments and Forms plugin for WordPress is vulnerable to Path Traversal via the 'recordings' comment field in all versions up to, and including, 2.3.3. This is due to the comment_post handler appending each comma-separated recording name directly to the user's recording directory path when the legacy HTML5 Videochat recorder mode is active, without sanitizing the name or checking that the path stays inside that directory. This makes it possible for unauthenticated attackers who can post comments to attach arbitrary server file paths to their comment's recording metadata, which reveals whether those files exist and how large they are, and makes the published comment link to them.
References
- https://wpsec.com/vuln/WPSEC-2026-2434/
- https://plugins.svn.wordpress.org/video-comments-webcam-recorder/tags/2.3.4/
- https://wordpress.org/plugins/video-comments-webcam-recorder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS