CVE-2025-6441

Critical

Published: 24 July 2025

Published

24 July 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0081 74.4th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-6441 is a critical-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations, directly addressing the missing capability checks that allow unauthenticated token generation for arbitrary users.

AC-6 Least Privilege good match

prevent

Implements least privilege to ensure plugin functions like webinarignition_sign_in_support_staff require appropriate capabilities, preventing unauthenticated exploitation.

SI-2 Flaw Remediation good match

prevent

Requires timely identification, reporting, and correction of flaws like CVE-2025-6441 in the WebinarIgnition plugin to eliminate the authentication bypass vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1078 Valid Accounts Stealth

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

attack.mitre.org →

Why these techniques?

Missing authorization in public WordPress plugin enables remote unauthenticated exploitation for auth bypass and valid account takeover.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

The Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition plugin for WordPress is vulnerable to unauthenticated login token generation due to a missing capability check on the `webinarignition_sign_in_support_staff` and `webinarignition_register_support` functions in all versions up to, and…

including, 4.03.32. This makes it possible for unauthenticated attackers to generate login tokens for arbitrary WordPress users under certain circumstances, issuing authorization cookies which can lead to authentication bypass.

Deeper analysisAI

CVE-2025-6441 affects the WebinarIgnition plugin for WordPress, which enables live, evergreen, automated, and instant webinars as well as Zoom Meetings streaming. The vulnerability involves unauthenticated login token generation stemming from a missing capability check in the `webinarignition_sign_in_support_staff` and `webinarignition_register_support` functions. This issue impacts all versions up to and including 4.03.32 and is rated with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), mapped to CWE-862 (Missing Authorization).

Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no privileges required. By invoking the affected functions, they can generate login tokens for arbitrary WordPress users under certain circumstances, resulting in the issuance of authorization cookies that enable authentication bypass. Successful exploitation grants high confidentiality, integrity, and availability impacts, potentially allowing full account takeover.

References to the vulnerability include WordPress plugin trac browser links pinpointing the flawed code in class-webinarignition.php (line 549), class.WebinarignitionAjax.php (line 769), and class.WebinarignitionManager.php (lines 1040 and 53), along with changeset 3333177, which likely addresses the issue in newer versions beyond 4.03.32.