CVE-2024-11271

CVE-2024-11271 is a data modification vulnerability in the WordPress Webinar Plugin – WebinarPress for WordPress, affecting all versions up to and including 1.33.24. It stems from a missing capability check on several functions, mapped to CWE-862 (Missing Authorization), which allows unauthorized alterations to webinar data. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), highlighting its high severity due to potential impacts on confidentiality, integrity, and availability.

Authenticated attackers with subscriber-level access or higher can exploit this vulnerability remotely with low complexity and no user interaction. Exploitation enables them to modify webinars, potentially disrupting events, altering registrations, or manipulating configurations without elevated privileges.

Mitigation details are provided in the plugin's WordPress trac changeset at https://plugins.trac.wordpress.org/changeset/3216237/wp-webinarsystem/trunk/includes/class-webinarsysteem-ajax.php, which addresses the missing checks. Wordfence threat intelligence offers further analysis at https://www.wordfence.com/threat-intel/vulnerabilities/id/88508dbd-b7a0-441d-918b-f4cb7a7cd000?source=cve. Practitioners should update to a version beyond 1.33.24 and review access controls on affected sites.