Missing authorization in the WebinarPress plugin allows an attacker to access protected resources without proper verification. The flaw stems from incorrect configuration of access control security levels, classified as CWE-862. An adversary could exploit this to read or modify data intended for authorized users, potentially exposing confidential webinar content or altering scheduling data. The impact is limited to the scope of roles affected by the plugin, but can compromise all stored webinar information if elevated privileges are abused.

WordPress installations running the WebinarPress plugin for WPWebinarSystem, all releases up to and including 1.33.28.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Because the plugin operates via the web interface, the likely attack vector is remote, but the attacker would need to target a WordPress site that has the vulnerable plugin installed and may require valid user credentials or the ability to manipulate role assignments. Availability impact is low; the issue primarily threatens confidentiality and integrity of webinar data.