Executive brief
The Ziggeo plugin for WordPress, which integrates video recording and playback services, contains a security flaw that allows low-level users to perform administrative actions. An attacker with a basic subscriber account could modify website translations, change event templates, or alter notification settings. This could lead to unauthorized changes to the website's appearance and functionality, potentially disrupting operations or misleading visitors.
Technical details
The Ziggeo plugin for WordPress fails to implement proper authorization checks in its 'wp_ajax_ziggeo_ajax' handler. While the handler validates a security nonce using 'check_ajax_referer', it lacks 'current_user_can()' capability checks to verify the user's permissions. Furthermore, the required nonce ('ziggeo_ajax_nonce') is leaked to all logged-in users via the 'wp_head' and 'admin_head' hooks. This allows authenticated attackers with Subscriber-level privileges or higher to execute administrative functions, such as updating 'ziggeo_translations', 'ziggeo_events', and 'ziggeo_notifications' options via the WordPress 'update_option' function. A patch appears to be available in versions following 3.1.1.
Affected products
- oliverfriedmann Ziggeo <= 3.1.1
Timeline
- 2026-04-09: disclosed
- 2026-04-09: advisory
References
- https://plugins.trac.wordpress.org/browser/ziggeo/tags/3.1.1/admin/page_editor_events_ajax.php
- https://plugins.trac.wordpress.org/browser/ziggeo/tags/3.1.1/admin/page_sdk_ajax.php
- https://plugins.trac.wordpress.org/browser/ziggeo/tags/3.1.1/admin/page_translations_ajax.php
- https://plugins.trac.wordpress.org/browser/ziggeo/tags/3.1.1/core/ajax.php
- https://plugins.trac.wordpress.org/browser/ziggeo/tags/3.1.1/core/header.php
- https://plugins.trac.wordpress.org/browser/ziggeo/trunk/admin/page_editor_events_ajax.php
- https://plugins.trac.wordpress.org/browser/ziggeo/trunk/admin/page_sdk_ajax.php