What is the CVSS score of CVE-2026-107426?

CVE-2026-107426 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-107426?

Within 24 hours, inventory all WordPress installations for the VideoWhisper Paid Videochat Turnkey Site (ppv-live-webcams) plugin and confirm if versions through 7.5.12 are present; if so, restrict access to the plugin's endpoints via network controls (e.g., IP allowlisting) or disable the plugin if not business-critical. Within 7 days, implement virtual patching through a Web Application Firewall (WAF) with rules that block unauthenticated requests to the plugin's vulnerable functionality, and review logs for any unauthorized activity; also consider temporarily removing the plugin if it cannot be adequately secured. Within 30 days, continue monitoring the vendor for a patch and upgrade to a fixed version as soon as it is released, while maintaining compensating controls until then; if no patch is forthcoming, evaluate the business need for the plugin and consider replacing it with a secure alternative.

VideoWhisper Paid Videochat CVE-2026-107426

EUVD-2026-101022 HIGH

Missing Authorization (CWE-862)

2026-10-14 Patchstack

GHSA-38w9-qq5p-92r9

WordPress Authentication Bypass Wordpress Plugin Paid Videochat Turnkey Site Videowhisper Com

7.3

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify vulnerable plugin endpoint
Delivery

Send crafted unauthenticated HTTP request
Exploit

Bypass missing authorization check
Execution

Invoke restricted function
Impact

Alter or disclose limited data

Vulnerability Assessment

Weakness	CWE CWE-862 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Authorization checks on every request MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The target must be a WordPress site running the VideoWhisper 'Paid Videochat Turnkey Site' (ppv-live-webcams) plugin at any version from n/a through 7.5.12, with the affected feature reachable. Per the CVSS vector (PR:N/UI:N), exploitation requires no authentication and no user interaction against network-reachable installations. The primary limiting factor is deployment prevalence: this is a specialized pay-per-view videochat plugin with a narrow install base, and the Low C/I/A ratings indicate the accessible functionality grants only limited data exposure or modification rather than full site compromise. The description does not name the specific endpoint or configuration, so the exact precondition on the plugin side could not be extracted from the available data.
Impact	The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 7.3) describes a network-reachable, low-complexity, unauthenticated missing-authorization flaw (CWE-862) with low-but-present impact across confidentiality, integrity, and availability - consistent with a broken access control issue where an actor reaches a function without the required capability check. No EPSS score, no CISA KEV listing, and no public POC were supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. This profile is a classic 'easy-to-trigger but moderate-impact' Patchstack-reported WordPress plugin issue: the unauthenticated network vector keeps attention warranted, but the uniformly Low impact ratings and the absence of exploitation signals (no KEV, no EPSS, no POC) argue against treating it as a top-tier emergency. The description phrase 'Exploiting Incorrectly Configured Access Control Security Levels' is vague and does not specify the exact endpoint or action affected, so the precise impact of the missing authorization should be verified against the Patchstack advisory before final prioritization.
Exploit ScenarioDerived	A remote, unauthenticated attacker sends a crafted HTTP request directly to a plugin endpoint or AJAX action that lacks a proper capability/authorization check, invoking functionality intended to be restricted. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no login, user interaction, or special timing is required, though each of confidentiality, integrity, and availability impact is rated Low. No public exploit code was identified in the provided data.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 14, 2026

Missing authorization in the VideoWhisper Paid Videochat Turnkey Site (ppv-live-webcams) WordPress plugin, in all versions through 7.5.12, lets unauthenticated remote attackers invoke plugin functionality that should be gated behind an access-control check, rated CVSS 3.1 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The accessible functionality yields only low confidentiality, integrity and availability impact rather than full site compromise, and real-world exposure is bounded by the narrow install base of this specialized pay-per-view videochat plugin. No public exploit code and no confirmed active exploitation were identified at time of analysis.

RemediationAI

The provided intelligence does not identify a vendor-published fixed version; treat all releases through 7.5.12 as vulnerable and consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-plugin-7-5-12-broken-access-control-vulnerability?_s_id=cve) and the vendor's ppv-live-webcams plugin page for the patched release before upgrading past 7.5.12, since the exact fixed number is not confirmed in the available data. If the videochat/pay-per-view functionality is not actively in use, deactivating and removing the plugin eliminates the attack surface entirely, at the cost of losing that feature. Where the plugin must stay active and no patched release is available, use a WAF or reverse proxy to block unauthenticated requests to the plugin's reachable entry points (its admin-ajax.php actions, REST routes, and direct plugin PHP paths) and to log or rate-limit attempts, accepting the trade-off that legitimate guest or pay-per-view viewers reaching the same endpoints may be blocked or degraded. Additionally, restrict the plugin's public pages to authenticated or subscribed users via role/membership rules, and monitor plugin-related requests for unexpected unauthenticated activity, since the flaw requires no login and no user interaction.

Affected VersionsENISA

Paid Videochat Turnkey Site 0 ≤7.5.12

Affected Packages

euvd paid_videochat_turnkey_site no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The issue is CWE-862 (Missing Authorization) in the WordPress plugin distributed as ppv-live-webcams, with the CPE cpe:2.3:a:videowhisper.com:paid_videochat_turnkey_site:* marking every published plugin version as in scope. Patchstack, the reporting source, classifies it under broken access control / authentication bypass tags, which is the WordPress ecosystem's typical framing for an entry point (admin-ajax.php action, REST route, or directly reachable plugin PHP file) that performs a privileged operation without the required current_user_can() capability check, role check, or equivalent authorization gate. Because the CVSS vector is PR:N and UI:N, the vulnerable entry point is reachable over the network without credentials and without luring a victim into an action; because the scope is unchanged and all three impact metrics are Low, the reachable function only exposes or modifies limited data or state (for example restricted plugin configuration or content), not administrative control of the site. The available intelligence does not name the specific endpoint, action parameter, or configuration prerequisite inside the plugin, so the exact reachability precondition could not be extracted from the provided data.

Know when Paid Videochat Turnkey Site gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI 7.3 HIGH

Missing authorization reachable remotely over HTTP with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact kept Low across C/I/A as the exposed function affords only limited access.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

DescriptionCVE.org

Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.

Executive ViewAI

Why It Matters

The VideoWhisper Paid Videochat Turnkey Site (ppv-live-webcams) WordPress plugin, versions through 7.5.12, contains a missing authorization vulnerability that allows unauthenticated attackers to invoke restricted functionality. Although the impact is limited to low levels of confidentiality, integrity, and availability, and no public exploit identified at time of analysis, organizations relying on this specialized pay-per-view videochat plugin should prioritize remediation given the absence of a vendor patch. Leadership should be concerned because the vulnerability could be exploited by anyone with network access, potentially disrupting paid videochat services or exposing limited customer data, though the narrow install base reduces widespread risk.

Business Impact: Medium

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include disabling the plugin if not essential, restricting network access to the plugin's endpoints through IP allowlisting or .htaccess rules, deploying WAF rules to block unauthenticated requests to the vulnerable functionality, and monitoring logs for exploitation attempts. Additionally, consider virtual patching via a security plugin that can enforce authorization checks.

Threat Intelligence Overview

EPSS Score

0.3%

Top 83% exploitable

Prevalence

Low

niche WordPress videochat/pay-per-view plugin, limited deployment footprint

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.