CVE-2024-11271
Published: 08 January 2025
Summary
CVE-2024-11271 is a high-severity Missing Authorization (CWE-862) vulnerability in Webinarpress Webinarpress. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 41.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2024-11271 is a data modification vulnerability in the WordPress Webinar Plugin – WebinarPress for WordPress, affecting all versions up to and including 1.33.24. It stems from a missing capability check on several functions, mapped to CWE-862 (Missing Authorization), which allows unauthorized alterations to webinar data. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), highlighting its high severity due to potential impacts on confidentiality, integrity, and availability.
Authenticated attackers with subscriber-level access or higher can exploit this vulnerability remotely with low complexity and no user interaction. Exploitation enables them to modify webinars, potentially disrupting events, altering registrations, or manipulating configurations without elevated privileges.
Mitigation details are provided in the plugin's WordPress trac changeset at https://plugins.trac.wordpress.org/changeset/3216237/wp-webinarsystem/trunk/includes/class-webinarsysteem-ajax.php, which addresses the missing checks. Wordfence threat intelligence offers further analysis at https://www.wordfence.com/threat-intel/vulnerabilities/id/88508dbd-b7a0-441d-918b-f4cb7a7cd000?source=cve. Practitioners should update to a version beyond 1.33.24 and review access controls on affected sites.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-34328
Vulnerability details
The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to modification of data due to a missing capability check on several functions in all versions up to, and including, 1.33.24. This makes it possible for authenticated attackers, with…
more
subscriber-level access and above, to modify webinars.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization (CWE-862) in public-facing WordPress plugin directly enables remote exploitation via T1190; resulting unauthorized webinar data changes map to T1565.002.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources, directly countering the missing capability checks that allow unauthorized webinar data modification.
Employs least privilege to restrict subscriber-level users from performing webinar modifications, mitigating low-privilege unauthorized alterations.
Requires identification, reporting, and remediation of the specific plugin flaw via patching, eliminating the missing authorization vulnerability.