CVE Intelligence
Analysis AI-assisted

CVE-2026-42757: WebinarIgnition WordPress Plugin - Path Traversal Leading to Arbitrary File Deletion

A path traversal weakness (CWE-22) in the WebinarIgnition WordPress plugin, from Saleswonder Team, is reported to allow arbitrary file deletion, with affected versions listed through 4.08.253. Patchstack assigned a CVSS 3.1 base score of 9.9 (critical). The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a path traversal weakness (CWE-22) in the WebinarIgnition plugin for WordPress, published by Patchstack as CVE-2026-42757. The title describes the impact as arbitrary file deletion. The record was published on 2026-05-27 and its source status is listed as Deferred.

Impact

The CVSS 3.1 vector recorded for this issue is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, with a base score of 9.9. Read as recorded, it indicates network reachability, low attack complexity, low privileges required, no user interaction, a scope change, and high impact on confidentiality, integrity and availability. In practical terms, an account with low privileges could potentially affect files outside the intended directories, which is an inference from the vector and the title.

The SSVC data in the record lists technical impact as total and automatable as no.

Affected products and versions

  • Product: Saleswonder Team: Tobias WebinarIgnition (webinar-ignition).
  • Affected range in the record: up to 4.08.253 (written as ≤ 4.08.253 in the affected field and as 'from n/a through < 4.08.253' in the description).
  • No fixed version field is populated in the record. The title wording '< 4.08.253' suggests 4.08.253 as the first corrected release, which is an inference to confirm with the vendor or the Patchstack advisory.

Exploitation status

The record lists the issue as not present in CISA KEV. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00548 (percentile 0.44353) and the SSVC exploitation field is none. These are estimates and indicators, not confirmation of attacks.

Remediation and mitigation

  • Identify every site running WebinarIgnition and record the installed version.
  • Update the plugin to a release newer than 4.08.253 as soon as the vendor's guidance confirms it is available.
  • Where an update cannot be applied immediately, consider deactivating the plugin or restricting access to its administrative functions.
  • Limit the creation of low-privilege accounts and review which accounts can reach plugin features.
  • Review file permissions for the web server user so that it cannot modify or remove files beyond what the site requires.
  • Keep current, tested backups so deleted content can be restored.

Detection guidance

  • Review web server and application logs for unusual activity involving the plugin, particularly requests from low-privilege accounts that the site does not normally expect.
  • Compare file integrity baselines for the WordPress installation and the plugin directory to detect missing or altered files.
  • Monitor for unexpected changes to the site after plugin-related activity, and treat missing files as a potential indicator to investigate.

Limitations of the available information

  • The record does not include a fixed version, technical details of the vulnerable function, or the conditions needed for exploitation.
  • The affected range is written with different operators in different fields (≤ and <), so the exact boundary should be confirmed with the vendor or Patchstack.
  • The sources consulted are the NVD entry, the CVE Record and the Patchstack advisory. The EPSS date recorded (2026-10-13) is later than the publication date and should be checked against the current EPSS feed.

Frequently asked questions

Is CVE-2026-42757 being actively exploited?

The record lists the issue as not present in CISA KEV, and no confirmed exploitation appears in the sources consulted. The EPSS and SSVC values are indicators only.

Which WebinarIgnition versions are affected?

The record lists versions up to 4.08.253. The affected field uses 'less than or equal to' while the description uses 'through less than', so confirm the exact boundary with the vendor or Patchstack.

What should site owners do now?

Identify installed versions, update to a release newer than 4.08.253 once confirmed by the vendor, restrict low-privilege access, and keep verified backups.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.