What is the CVSS score of CVE-2025-8899?

CVE-2025-8899 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2025-8899?

A privilege escalation vulnerability in the Paid Videochat WordPress plugin allows authenticated users with basic access to elevate themselves to administrator status, potentially compromising site…

How to fix or mitigate CVE-2025-8899?

Within 24 hours: Audit all user accounts for unauthorized privilege escalation and review recent user registrations for suspicious activity. Within 7 days: Implement WAF rules blocking the videowhisper_register_form function or disable the plugin entirely if not business-critical. Within 30 days: Replace with an alternative solution or contact the vendor for an estimated patch timeline and evaluate alternative plugins with similar functionality.

WordPress CVE-2025-8899

HIGH

Improper Privilege Management (CWE-269)

2026-03-07 security@wordfence.com

WordPress Privilege Escalation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 07, 2026 - 06:16 nvd

HIGH 8.8

DescriptionCVE.org

The Paid Videochat Turnkey Site - HTML5 PPV Live Webcams plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.3.20. This is due to videowhisper_register_form() function not restricting user roles that can be set during registration. This makes it possible for authenticated attackers, with Author-level access and above, to create posts/pages with the registration form and administrator set as the role and subsequently use that form to register an administrator account. This can also be exploited by contributors, but is far less likely to be successful because an administrator would need to approve the form with the administrator role for the attack to be successful.

AnalysisAI

Technical ContextAI

This vulnerability (CWE-269: Improper Privilege Management) affects HTML5 PPV Live Webcam. The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.3.20. This is due to videowhisper_register_form() function not restricting user roles that can be set during registration. This makes it possible for authenticated attackers, with Author-level access and above, to create posts/pages with the registration form and administrator set as the role and subsequently use that form to register an admi