CVE-2025-6441criticalCWE-862

CVE-2025-6441: fallo crítico en tobias_conrad WebinarIgnition – Live…

Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition <= 4.03.32 - Unauthenticated Login Token Generation to Authentication Bypass

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear WebinarIgnition – Live, Automated & Evergreen Webinars for WooCommerce

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.8epss 1.1%
The Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition plugin for WordPress is vulnerable to unauthenticated login token generation due to a missing capability check on the `webinarignition_sign_in_support_staff` and `webinarignition_register_support` functions in all versions up to, and including, 4.03.32. This makes it possible for unauthenticated attackers to generate login tokens for arbitrary WordPress users under certain circumstances, issuing authorization cookies which can lead to authentication bypass.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
tobias_conrad · WebinarIgnition – Live, Automated & Evergreen Webinars for WooCommerce
CVEs relacionadas — tobias_conrad WebinarIgnition – Live…

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-4974MEDIUMFreemius SDK <= 2.4.2 - Missing Authorization ChecksEPSS 0.4%