What is the CVSS score of CVE-2025-62972?

CVE-2025-62972 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

WebinarPress CVE-2025-62972

MEDIUM

Missing Authorization (CWE-862)

2025-10-27 audit@patchstack.com

WordPress Authentication Bypass Webinarpress Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

4.3 MEDIUM

Network-accessible WordPress plugin endpoint requiring low-privilege authenticated access; impact limited to availability only per description and CWE-862 scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:18 vuln.today

CVE Published

Oct 27, 2025 - 02:15 cve.org

MEDIUM 4.3

DescriptionCVE.org

Missing Authorization vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebinarPress: from n/a through <= 1.33.28.

AnalysisAI

Missing authorization checks in WebinarPress (wp-webinarsystem) WordPress plugin version 1.33.28 and earlier allow authenticated low-privileged users to perform availability-impacting actions beyond their intended access level. The flaw stems from incorrectly configured access control security levels (CWE-862), enabling a WordPress subscriber-tier user to invoke plugin functionality restricted to higher roles. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS probability stands at 0.03%, indicating low real-world exploitation interest currently.

Technical ContextAI

WebinarPress (CPE: cpe:2.3:a:webinarpress:webinarpress:*:*:*:*:lite:wordpress:*:*) is a WordPress plugin providing webinar hosting and management capabilities. The vulnerability is classified under CWE-862 (Missing Authorization), meaning the plugin fails to enforce capability or nonce checks on one or more AJAX handlers, REST endpoints, or admin-facing actions - a common pattern in WordPress plugin vulnerabilities where developers register hooks without validating the requesting user's role against the intended access level. This allows a user authenticated at a low privilege tier (e.g., subscriber) to trigger actions designed for higher roles such as editors or administrators. The CVSS vector confirms network-accessible exploitation with no special attack complexity and only an availability impact (A:L), suggesting the exposed functionality can disrupt webinar-related data or operations rather than expose sensitive content.

RemediationAI

Update WebinarPress to a version released after 1.33.28 - the exact patched version is not independently confirmed from the provided data, so administrators should consult the plugin's WordPress.org changelog or the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-webinarsystem/vulnerability/wordpress-webinarpress-plugin-1-33-28-broken-access-control-vulnerability for the confirmed fixed release. As a compensating control, disable public user registration on the WordPress site (Settings > General > uncheck 'Anyone can register') to eliminate the low-privilege authenticated attack surface - note this prevents new user self-registration site-wide. Alternatively, restrict the WebinarPress plugin's AJAX or REST endpoints via a WAF rule targeting the specific plugin slug parameter, though this may disrupt legitimate plugin functionality. If the plugin is not actively used, deactivation is the lowest-risk interim mitigation.