The WebinarIgnition WordPress plugin allows an unauthenticated attacker to generate login tokens for arbitrary WordPress users because the functions webinarignition_sign_in_support_staff and webinarignition_register_support lack a required capability check. The generated tokens become authentication cookies, enabling an attacker to impersonate any site user and gain the privileges of that user, which can lead to full site compromise. This vulnerability is a classic example of Missing Permissions (CWE‑862).

The issue affects installations of the WebinarIgnition plugin for WooCommerce, developed by Tobias Conrad, with any version up to and including 4.03.32. Any WordPress site running one of these plugin versions is potentially vulnerable.

The CVSS score of 9.8 indicates critical severity, but the EPSS score of less than 1 % reflects a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is unauthenticated, relying solely on missing permission checks, so an adversary only needs the ability to send crafted HTTP requests to the vulnerable endpoints to achieve authentication bypass.