CVE-2026-105880: WordPress WebinarIgnition plugin <= 4.27.125 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Tobias WebinarIgnition webinar-ignition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebinarIgnition: from n/a through 4.27.125.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.27.136
Event History
Frequently Asked Questions
Which installations are affected?
WebinarIgnition versions through 4.27.125 are affected. The available information does not identify a lower fixed boundary or any unaffected configuration.
What level of access does an attacker need?
The CVSS vector indicates the issue can be exploited remotely with low attack complexity, without privileges or user interaction. It is an authorization bypass involving a user-controlled key.
What is the expected impact?
The vulnerability has a medium CVSS score of 5.3 and affects confidentiality at a low level. No integrity or availability impact is indicated.