The vulnerability is an incorrect privilege assignment in the Saleswonder Team: Tobias WebinarIgnition plugin for WordPress, allowing attackers to elevate their permissions beyond intended limits. Such privilege escalation could give an adversary control over the WordPress site, compromising confidentiality, integrity, and availability of website data. The weakness is categorized as CWE‑266, improper elevation of privileges.

Affected vendor and product: Saleswonder Team: Tobias WebinarIgnition plugin for WordPress. Any installation of this plugin using a version older than 4.08.253 is susceptible. WordPress sites that rely on the vulnerable plugin version are exposed to escalation risk.

The CVSS score of 9.8 classifies the issue as critical; the EPSS score is not reported and the vulnerability does not appear in CISA KEV. The description does not specify an attack vector or prerequisites, but since the plugin runs within WordPress, exploitation is likely delivered through web requests to the host site or administrative interfaces. Actual exploitation conditions are not detailed, so the threat remains high but the exact entry path is uncertain.