CVE-2026-107429

4.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-1284

Impact

Authenticated attackers can manipulate input data to alter specified quantities within the application. They need valid user credentials to interact with the plugin.

Root cause

The plugin improperly validates quantity values supplied in user input.

Affected systems

VideoWhisper.com Paid Videochat Turnkey Site (ppv-live-webcams) through 7.5.12

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Fix & remediation

Upgrade to a version higher than 7.5.12 if available, or deactivate the ppv-live-webcams plugin until a vendor patch is released.

shell

$ wp plugin deactivate ppv-live-webcams

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.

References

https://patchstack.com/database/wordpress/plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-plugin-7-5-12-other-vulnerability-type-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-107429