VideoWhisper Site Manager CVE-2026-107430

Exploitation requires an authenticated WordPress account on a site running VideoWhisper Site Manager for ChatGPT, Claude, Codex version 1.2.10 or earlier (PR:L - a valid, typically low-privilege account is needed; not fully unauthenticated). The flaw stems from incorrectly configured access control security levels on plugin functionality, meaning the vulnerable action is reachable because its authorization/capability check is missing or too permissive. No user interaction is required (UI:N) and the attack is remote over the network (AV:N) with low complexity (AC:L). Limiting factors: the attacker must first hold a site account, the plugin must be installed and active, and impact is confined to low confidentiality and low integrity with no availability effect, so this does not permit site takeover or denial of service on its own.

This is a moderate-severity (CVSS 5.4) broken access control / missing authorization flaw (CWE-862) in the VideoWhisper Site Manager WordPress plugin, reported by Patchstack. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N indicates a network-reachable, low-complexity attack that requires some level of authentication (PR:L), yields only low confidentiality and low integrity impact, and no availability impact. There is no public exploit identified at time of analysis, no EPSS score was provided in the input, and the CVE is NOT listed in CISA KEV - so there is no public exploit identified at time of analysis. All signals are internally consistent: a low-privilege authenticated user can exploit an access-control misconfiguration to perform actions or read/modify data they should not be authorized for, but the limited impact (L/L/N) and the authentication requirement keep real-world risk bounded. This should be treated as a routine patch-management item for sites running the plugin rather than an emergency; the primary limiting factor is that an attacker must already hold a valid (likely low-privilege) WordPress account. Note that EPSS data is missing from the input, so probabilistic exploitation likelihood could not be weighed.

An attacker who has registered or obtained a low-privilege account on a WordPress site running VideoWhisper Site Manager (≤ 1.2.10) sends a crafted request to a plugin endpoint that fails to properly check the caller's authorization level. Because access control is incorrectly configured, the request succeeds and lets the attacker read or alter plugin-managed data or settings they should not be able to touch. No public proof-of-concept is identified at time of analysis, and the low attack complexity means exploitation is straightforward once an account is held.