CVE-2025-47635 is a medium severity server side request forgery flaw (CVSS 5.5) in WebinarPress for WordPress. The record lists versions through 1.33.28, and Patchstack lists 1.33.31 as the patched version. Update to 1.33.31 or later, and note that an administrator account is needed.
What's affected
The record says WebinarPress by WPWebinarSystem is affected through 1.33.28. Patchstack's current entry gives the vulnerable range as through 1.33.30 and the patched version as 1.33.31. The two sources differ, so use the safer rule and move to 1.33.31 or later.
The vector requires high privileges, which Patchstack describes as an administrator. That lowers the practical risk, because the attacker already holds a powerful account. The scope is marked as changed, so the effect can cross into other systems.
The record does not mark CVE-2025-47635 as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
On the server, WP-CLI shows the installed version and whether the plugin is active:
wp plugin list --name=wp-webinarsystem --fields=name,version,status,update
If WP-CLI is not available, open Plugins in the WordPress admin and read the version under the plugin name. Compare it with the affected range above. A deactivated plugin is lower risk than an active one, but it still sits on disk, so remove it if you do not use it.
Also check who holds administrator accounts on the site. A server side request flaw behind admin login matters most when admin accounts are shared, weak or stolen.
What to do now
- Update WebinarPress to 1.33.31 or later. With WP-CLI that is
wp plugin update wp-webinarsystem. - Take a backup first if the site is busy, and test the update on a staging copy when you can.
- If you do not use the plugin, deactivate and delete it.
- Review your administrator list and enable two factor login for admins, since the flaw needs that level of access.
- Review your plugin list for anything else that is out of date. Old plugins are where most WordPress incidents begin.
- Turn on automatic updates for plugins you trust, or add a regular review to your calendar.
If you want a quick look at what your own projects pull in, the free in-browser dependency scan at https://gold.safeguard.sh/scan needs no setup. The Gold directory lets you look up other CVEs by id.
Why it matters
This is CWE-918, server side request forgery. The plugin makes a web request on behalf of the user, and the destination is not restricted enough. That lets a signed in administrator point the server at addresses it can reach, including internal ones.
Because an admin account is required, the bigger lesson is account hygiene. Flaws that need a privileged login become serious when that login is phished or reused. Limit admin accounts, use strong authentication, and update plugins on a schedule.
WordPress plugins run with the same trust as the rest of the site. A weakness in one small add on is a weakness in the whole install, and plugin flaws are easy to find at scale because the code is public and the plugin slugs are predictable.
Quick check
Which versions of WebinarPress are affected by CVE-2025-47635?
The record says through 1.33.28. Patchstack's current page says through 1.33.30. Update to 1.33.31 or later to be safe.
Does an attacker need to log in?
Yes. The vector requires high privileges, which Patchstack describes as administrator.
Sources
Last reviewed: 18 October 2026.
