CVE-2026-107430

5.4Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.4Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Authenticated attackers with low-privilege accounts can bypass access control checks to read and modify site manager settings. They only need valid credentials on the target WordPress site.

Root cause

The plugin fails to perform authorization checks on restricted actions, allowing lower-privileged users to access sensitive functionality.

Affected systems

VideoWhisper Site Manager for ChatGPT, Claude, Codex through 1.2.10

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Fix & remediation

Upgrade the plugin to a version newer than 1.2.10 if available, or deactivate and delete the plugin immediately via the WordPress admin panel or CLI.

shell

$ wp plugin deactivate videowhisper-site-manager

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex videowhisper-site-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VideoWhisper Site Manager for ChatGPT, Claude, Codex: from n/a through 1.2.10.

References

https://patchstack.com/database/wordpress/plugin/videowhisper-site-manager/vulnerability/wordpress-videowhisper-site-manager-for-chatgpt-claude-codex-plugin-1-2-10-broken-access-control-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-107430