The vulnerability is a missing authorization flaw that allows attackers to perform actions that should be restricted. The flaw is classified as CWE-862, which indicates improper privilege or permission handling. An attacker empowered by this weakness can access or manipulate webinar configurations and participant data beyond their intended privileges, potentially exposing sensitive information or disrupting scheduled events.

WordPress sites that use the WPWebinarSystem WebinarPress plugin, including the lite version, are affected when running versions up to and including 1.33.28. The vulnerability applies to all deployments of the plugin with any user role that can interact with the webinar management interface.

The CVSS score is 4.3, representing moderate severity, and the EPSS score is less than 1%, indicating a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote access via HTTP requests to the plugin’s API or administrative pages. An attacker does not need special privileges beyond being able to reach the site; typical exploitation would involve sending crafted requests to the plugin endpoints to elevate privileges or access restricted data.