What is the CVSS score of CVE-2025-62959?

CVE-2025-62959 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2025-62959?

The VideoWhisper Paid Videochat Turnkey Site WordPress plugin (versions ≤7.3.23) contains a critical remote code execution vulnerability exploitable by authenticated administrators, creating insider…

How to fix or mitigate CVE-2025-62959?

Within 24 hours: Identify all WordPress instances running VideoWhisper plugin ≤7.3.23 using vulnerability scanning; document all current administrator accounts and review access logs for suspicious activity. Within 7 days: Either disable/uninstall the plugin if not business-critical, or implement strict administrator role controls (limit to essential personnel, enforce MFA on admin accounts, and restrict admin dashboard access by IP whitelist). Within 30 days: Contact VideoWhisper for patch timeline; if no patch released, evaluate alternative video communication plugins and plan migration.

PHP CVE-2025-62959

CRITICAL

Code Injection (CWE-94)

2025-10-27 audit@patchstack.com

WordPress PHP Code Injection RCE

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 27, 2025 - 02:15 nvd

CRITICAL 9.1

DescriptionCVE.org

Improper Control of Generation of Code ('Code Injection') vulnerability in videowhisper Paid Videochat Turnkey Site ppv-live-webcams allows Remote Code Inclusion.This issue affects Paid Videochat Turnkey Site: from n/a through <= 7.3.23.

AnalysisAI

Remote code execution in the VideoWhisper Paid Videochat Turnkey Site WordPress plugin (versions up to 7.3.23) allows authenticated administrators to inject and execute arbitrary code through code injection vulnerabilities. The CVSS 9.1 severity reflects scope change and high impact across confidentiality, integrity, and availability. EPSS exploitation probability is low at 0.04% (13th percentile), and no public exploit identified at time of analysis, suggesting this remains a theoretical high-severity issue requiring privileged access rather than an imminent mass-exploitation threat.

Technical ContextAI

This vulnerability stems from CWE-94 (Improper Control of Generation of Code), commonly known as code injection. The affected component is a WordPress plugin providing paid live video chat functionality. The flaw allows attackers with high-privilege access (PR:H in CVSS vector indicates administrative credentials required) to inject malicious code that gets evaluated or executed by the application. Code injection differs from command injection by targeting the application's code interpreter directly, allowing arbitrary PHP code execution in WordPress contexts. The scope change (S:C) in the CVSS vector indicates the vulnerability can affect resources beyond the vulnerable component's security scope, potentially compromising the entire WordPress installation and underlying server. The network attack vector (AV:N) and low complexity (AC:L) indicate exploitation is straightforward once admin credentials are obtained.

Affected ProductsAI

The vulnerability affects the VideoWhisper Paid Videochat Turnkey Site WordPress plugin (also known as ppv-live-webcams) in all versions from the earliest release through version 7.3.23 inclusive. This is a commercial plugin for WordPress installations providing paid live webcam streaming functionality. The vendor is identified as videowhisper. Organizations running WordPress sites with this plugin installed should verify their installed version immediately. The Patchstack reference at https://patchstack.com/database/Wordpress/Plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-plugin-7-3-22-remote-code-execution-rce-vulnerability provides additional technical details, noting the issue was present in version 7.3.22 and earlier versions up to the confirmed 7.3.23.

RemediationAI

Organizations should immediately upgrade the Paid Videochat Turnkey Site plugin to a version later than 7.3.23 if available from the vendor. At the time of analysis, upstream fix availability is not independently confirmed from the provided data sources. Administrators should check the official VideoWhisper website and WordPress plugin repository for updated versions addressing CVE-2025-62959. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-plugin-7-3-22-remote-code-execution-rce-vulnerability for vendor-specific guidance. As an interim mitigation, implement strict controls on WordPress administrator account access, enforce multi-factor authentication for all admin users, monitor admin activity logs for suspicious code execution patterns, and consider temporarily disabling the plugin if it is not business-critical until a confirmed patch is available. Review and restrict file upload capabilities and any plugin features that accept user-controlled input for code evaluation.