WebinarIgnition CVE-2026-42758

The target must be a WordPress site running the WebinarIgnition plugin at any version below 4.08.253 (through 4.08.252), with the plugin active and its endpoints reachable over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special configuration, no authentication, and no user interaction are stated to be required, so default installations of vulnerable versions are exposed. The principal limiting factor is simply whether the plugin is installed, active, and network-accessible; the only other caveat is the CWE-266/PR:N tension noted above - confirm via the Patchstack advisory whether a low-privilege session is in fact needed, as that would meaningfully reduce realistic exploitability.

The signals conflict and warrant nuance. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a worst-case, trivially exploitable remote unauthenticated privilege escalation, scoring 9.8. However, the EPSS probability is only 0.04% (13th percentile), there is no KEV listing, and no public exploit exists, so real-world exploitation is currently neither observed nor predicted to be widespread. This remains a high-priority patching item for any site running the plugin because the theoretical barrier to exploitation is nil, but the absence of public PoC and the low EPSS suggest it is not under active mass exploitation. One tension to verify with the vendor: incorrect privilege assignment (CWE-266) sometimes requires an existing low-privilege authenticated session in practice, whereas CVSS PR:N asserts no privileges are needed - the Patchstack advisory should be consulted to confirm whether truly unauthenticated access is required.

An attacker sends a crafted request over the network to a vulnerable WebinarIgnition endpoint on a target WordPress site, invoking an operation that assigns privileges incorrectly and thereby elevating their effective rights without prior authentication or user interaction. With elevated privileges they could modify site content, access sensitive data, or pivot toward full site compromise. No public proof-of-concept exploit was identified at time of analysis, and the CVSS AC:L/UI:N profile indicates that, if a working exploit emerged, it would require low effort and no victim interaction.