CVE-2026-107426: WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerability
Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Paid Videochat Turnkey Site pluginto a version that resolves this vulnerability.Fixed in 7.5.13
Event History
Frequently Asked Questions
Which installations should be prioritized for remediation?
Installations using the VideoWhisper.com Paid Videochat Turnkey Site plugin are affected through version 7.5.12. The available data does not identify a lower affected version boundary.
Does exploitation require an authenticated WordPress user or user interaction?
No. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required. The reported impact is limited confidentiality, integrity, and availability impact.