# Video Comments Webcam Recorder <= 2.3.3 - Unauthenticated Path Traversal via Comment Recording References

- **ID:** WPSEC-2026-2434
- **Plugin:** Webcam/Screen/Mic Recorder for Video Comments and Forms (`video-comments-webcam-recorder`), https://wordpress.org/plugins/video-comments-webcam-recorder/
- **Affected versions:** all versions before 2.3.4
- **Fixed in:** 2.3.4 (Update to 2.3.4 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/video-comments-webcam-recorder
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2434/

## Description

The Webcam/Screen/Mic Recorder for Video Comments and Forms plugin for WordPress is vulnerable to Path Traversal via the 'recordings' comment field in all versions up to, and including, 2.3.3. This is due to the comment_post handler appending each comma-separated recording name directly to the user's recording directory path when the legacy HTML5 Videochat recorder mode is active, without sanitizing the name or checking that the path stays inside that directory. This makes it possible for unauthenticated attackers who can post comments to attach arbitrary server file paths to their comment's recording metadata, which reveals whether those files exist and how large they are, and makes the published comment link to them.

## References

- https://wpsec.com/vuln/WPSEC-2026-2434/
- https://plugins.svn.wordpress.org/video-comments-webcam-recorder/tags/2.3.4/
- https://wordpress.org/plugins/video-comments-webcam-recorder/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2434/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.