WordPress Plugin Vulnerabilities

WP GoToWebinar < 15.7 - Missing Authorization

Description

The WP GoToWebinar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wp_gotowebinar_get_access_and_refresh_token_call() function in versions up to, and including, 15.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to refresh a token.

Affects Plugins

Plugin icon
wp-gotowebinar
Fixed in 15.7

References

CVE
CVE-2024-38695
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/8314f607-5904-4da8-b2a2-5d77e2edc764

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Majed Refaea
Verified
No
WPVDB ID
391920cd-7aa3-4d2c-b03a-78ba9a026225

Timeline

Publicly Published
2024-07-11 (about 2 years ago)
Added
2024-07-17 (about 2 years ago)
Last Updated
2024-07-17 (about 2 years ago)

Other

Published
Title
Published
2023-06-26
Title
WooCommerce Stripe Payment Gateway < 7.4.1 - Subscriber+ Order Intent Update
Published
2024-07-08
Title
Pie Register - Basic <= 3.8.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation/Deactivation
Published
2025-04-07
Title
SEO Help < 6.8.6 - Missing Authorization
Published
2026-02-18
Title
Dealia – Request a quote < 1.0.8 - Missing Authorization to Authenticated (Contributor+) Plugin Configuration Reset
Published
2025-08-26
Title
Zephyr Project Manager < 3.3.202 - Missing Authorization