What is the CVSS score of CVE-2026-107429?

CVE-2026-107429 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

VideoWhisper Paid Videochat CVE-2026-107429

EUVD-2026-97288 MEDIUM

Improper Validation of Specified Quantity in Input (CWE-1284)

2026-10-12 Patchstack

GHSA-vwjq-q23m-774h

WordPress Information Disclosure Wordpress Plugin Paid Videochat Turnkey Site Videowhisper Com

4.3

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate as low-privileged user
Exploit

Submit request with manipulated quantity input
Execution

Bypass improper input validation
Impact

Tamper limited plugin data

Vulnerability Assessment

Weakness	CWE CWE-1284 ASVS 5.0 V2 - Validation and Business Logic Input size validation
Exploitation Conditions	Exploitation requires an authenticated account on a WordPress site running the VideoWhisper Paid Videochat Turnkey Site (ppv-live-webcams) plugin at version 7.5.12 or earlier; the attacker must be able to reach a plugin input field that accepts a quantity/specified-value parameter the code fails to validate. Limiting factors: the PR:L requirement means anonymous/unauthenticated visitors cannot exploit it, and the impact is confined to limited integrity (data manipulation) with no confidentiality or availability effect, so realistic risk is low even though the vector is network-based with no user interaction.
Impact	This is a moderate-severity, low-priority issue despite being network-reachable. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) shows a network vector with low attack complexity but requires at least low-level privileges (PR:L), limiting it to authenticated users, and yields only a limited integrity impact (I:L) with no confidentiality or availability impact. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a signal conflict: the input Tags label this 'Information Disclosure,' but the CVSS vector explicitly sets C:N (no confidentiality impact) and I:L (limited integrity impact), and both the CWE (CWE-1284, Improper Validation of Specified Quantity) and the description ('Input Data Manipulation') point to a data-integrity/input-validation weakness rather than disclosure - the 'Information Disclosure' tag appears mislabeled and should be verified. Overall this reads as a genuine but low-impact authenticated input-validation flaw in a niche WordPress plugin, not an urgent widespread threat.
Exploit ScenarioDerived	An authenticated user of a WordPress site running the Paid Videochat Turnkey Site plugin (≤7.5.12) submits a crafted request manipulating an input quantity field that the plugin fails to validate, causing it to accept out-of-range or malformed data. Because attack complexity is low and only low privileges are needed, the manipulation can be performed reliably through the normal application interface, producing a limited integrity impact on plugin data. No public proof-of-concept exploit was identified in the provided data.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 12, 2026

Authenticated users of a WordPress site running the Paid Videochat Turnkey Site plugin (ppv-live-webcams) through version 7.5.12 can manipulate quantity/specified-value input parameters because the plugin fails to properly validate them (CWE-1284). Rated CVSS 3.1 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), the flaw is network-reachable but demands a logged-in account and yields only limited integrity impact, with no confidentiality or availability effect. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a moderate-severity, low-priority hardening item rather than an urgent threat.

RemediationAI

No vendor-released patch version is identified in the available data; version 7.5.12 is documented as the last affected release, so administrators should check the plugin's update channel for any release newer than 7.5.12 and apply the highest available version, treating the Patchstack entry (https://patchstack.com/database/wordpress/plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-plugin-7-5-12-other-vulnerability-type-vulnerability?_s_id=cve) as the tracking reference until a fixed build appears - absence of a documented fix version should not be read as confirmation that none exists. Because exploitation requires an authenticated account (PR:L), the most effective compensating controls are access-side: audit and minimize the number of low-privilege WordPress accounts (subscribers, customers, and any roles that can reach the plugin's AJAX/REST or front-end input handlers), and tighten role capabilities so only trusted roles can submit the plugin's quantity-bearing parameters; the trade-off is that this reduces the site's legitimate paid-user onboarding until roles are re-mapped. If the plugin or its pay-per-view/chat features are not actively used, deactivating and deleting it removes exposure entirely, at the cost of losing that functionality. If the plugin must remain live, add a small site-specific mu-plugin or WAF rule that server-side validates and clamps the numeric/specified-quantity parameters accepted by the plugin's endpoints to expected ranges and types - a targeted, low-risk control, though it requires identifying the exact parameter names from the plugin code, which the available public data does not enumerate. Finally, enable logging on plugin input handlers to detect manipulation attempts, recognizing that this provides detection rather than prevention.

Affected VersionsENISA

Paid Videochat Turnkey Site 0 ≤7.5.12

Affected Packages

euvd paid_videochat_turnkey_site no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is a WordPress plugin distributed as ppv-live-webcams and marketed as Paid Videochat Turnkey Site by VideoWhisper.com, tracked by CPE cpe:2.3:a:videowhisper.com:paid_videochat_turnkey_site. The root cause falls under CWE-1284 (Improper Validation of Specified Quantity in Input), a weakness class in which a component accepts a numeric or size/count parameter - such as a token amount, credit quantity, broadcast/stream count, duration, or similar specified-value field - without verifying that it falls within an expected range or is of the expected type. Because the plugin handles paid video chat features including pay-per-view accounting, an unvalidated quantity field allows the value passed into server-side logic to be altered after it has been accepted, producing input data manipulation. The plugin's request handling occurs over HTTP within the WordPress application, so the flaw is network-reachable (AV:N) with low attack complexity (AC:L), but the CVSS vector requires privileges (PR:L) and no user interaction (UI:N), and the scope is unchanged with only a low integrity impact. There is no path to reading protected data or to denial of service described in the available evidence. Notably the Patchstack report is classified as an 'other vulnerability type' entry, and no vendor-supplied technical detail, CWE-1284-specific parameter name, or proof-of-concept has been published in the supplied references.

Know when Paid Videochat Turnkey Site gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI 4.3 MEDIUM

Network-reachable plugin endpoint (AV:N/AC:L) exploitable by a low-privileged authenticated user (PR:L); input manipulation yields only limited integrity impact (I:L), with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

DescriptionCVE.org

Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.

Threat Intelligence Overview

EPSS Score

0.2%

Top 95% exploitable

Prevalence

Low

niche pay-per-view WordPress webcam plugin, limited deployment

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +22

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.