CVE-2025-62959
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2Tags
Description
Improper Control of Generation of Code ('Code Injection') vulnerability in videowhisper Paid Videochat Turnkey Site ppv-live-webcams allows Remote Code Inclusion.This issue affects Paid Videochat Turnkey Site: from n/a through <= 7.3.23.
Analysis
Remote code execution in the VideoWhisper Paid Videochat Turnkey Site WordPress plugin (versions up to 7.3.23) allows authenticated administrators to inject and execute arbitrary code through code injection vulnerabilities. The CVSS 9.1 severity reflects scope change and high impact across confidentiality, integrity, and availability. EPSS exploitation probability is low at 0.04% (13th percentile), and no public exploit identified at time of analysis, suggesting this remains a theoretical high-severity issue requiring privileged access rather than an imminent mass-exploitation threat.
Technical Context
This vulnerability stems from CWE-94 (Improper Control of Generation of Code), commonly known as code injection. The affected component is a WordPress plugin providing paid live video chat functionality. The flaw allows attackers with high-privilege access (PR:H in CVSS vector indicates administrative credentials required) to inject malicious code that gets evaluated or executed by the application. Code injection differs from command injection by targeting the application's code interpreter directly, allowing arbitrary PHP code execution in WordPress contexts. The scope change (S:C) in the CVSS vector indicates the vulnerability can affect resources beyond the vulnerable component's security scope, potentially compromising the entire WordPress installation and underlying server. The network attack vector (AV:N) and low complexity (AC:L) indicate exploitation is straightforward once admin credentials are obtained.
Affected Products
The vulnerability affects the VideoWhisper Paid Videochat Turnkey Site WordPress plugin (also known as ppv-live-webcams) in all versions from the earliest release through version 7.3.23 inclusive. This is a commercial plugin for WordPress installations providing paid live webcam streaming functionality. The vendor is identified as videowhisper. Organizations running WordPress sites with this plugin installed should verify their installed version immediately. The Patchstack reference at https://patchstack.com/database/Wordpress/Plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-plugin-7-3-22-remote-code-execution-rce-vulnerability provides additional technical details, noting the issue was present in version 7.3.22 and earlier versions up to the confirmed 7.3.23.
Remediation
Organizations should immediately upgrade the Paid Videochat Turnkey Site plugin to a version later than 7.3.23 if available from the vendor. At the time of analysis, upstream fix availability is not independently confirmed from the provided data sources. Administrators should check the official VideoWhisper website and WordPress plugin repository for updated versions addressing CVE-2025-62959. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-plugin-7-3-22-remote-code-execution-rce-vulnerability for vendor-specific guidance. As an interim mitigation, implement strict controls on WordPress administrator account access, enforce multi-factor authentication for all admin users, monitor admin activity logs for suspicious code execution patterns, and consider temporarily disabling the plugin if it is not business-critical until a confirmed patch is available. Review and restrict file upload capabilities and any plugin features that accept user-controlled input for code evaluation.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today