How severe is CVE-2025-6441?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Tobias Conrad Webinarignition – Live, Automated & Evergreen Webinars For Woocommerce

CVE-2025-6441

The Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition plugin for WordPress is vulnerable to unauthenticated login token generation due to a missing capability check on the `webinarignition_sign_in_support_staff` and `webinarignition_register_support` functions in all versions up to, and including, 4.03.32. This makes it possible for unauthenticated attackers to generate login tokens for arbitrary WordPress users under certain circumstances, issuing authorization cookies which can lead to authentication bypass.

Vulnerability class: Broken Access Control

EPSS: 0.010 (58.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Tobias_conrad Webinarignition – Live, Automated & Evergreen Webinars For Woocommerce — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

Frequently asked questions

What is CVE-2025-6441?: CVE-2025-6441 is a critical-severity vulnerability in Tobias Conrad Webinarignition – Live, Automated & Evergreen Webinars For Woocommerce, classified under Missing Authorization. CVSS score: 9.8/10. Published 2025-07-24.
How severe is CVE-2025-6441?: Critical severity. CVSS v3 base score is 9.8 out of 10.