CVE-2026-107421
7.3HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-384
Impact
Unauthenticated remote attackers can hijack user sessions without requiring interaction. This allows unauthorized access to compromise the integrity and confidentiality of target accounts.
Root cause
The plugin fails to renew or invalidate existing session identifiers, resulting in a session fixation flaw.
Affected systems
Broadcast Live Video (videowhisper-live-streaming-integration) WordPress plugin through version 7.3.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
Upgrade to a version higher than 7.3.2 once available from the vendor. If an update cannot be applied immediately, deactivate and disable the videowhisper-live-streaming-integration plugin.
$ wp plugin deactivate videowhisper-live-streaming-integrationAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2.