CVE-2026-107426

7.3High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.3High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Unauthenticated remote attackers can bypass access controls to view, modify, or disrupt site resources. No prior privileges or user interaction are required.

Root cause

The plugin fails to perform authorization checks, allowing requests to execute without proper permission verification.

Affected systems

Paid Videochat Turnkey Site (ppv-live-webcams) through 7.5.12.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Fix & remediation

Upgrade to a version higher than 7.5.12 once published by the vendor, or deactivate and remove the plugin immediately if an update is unavailable.

shell

$ wp plugin deactivate ppv-live-webcams

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.

References

https://patchstack.com/database/wordpress/plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-plugin-7-5-12-broken-access-control-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-107426