VideoWhisper MicroPayments CVE-2026-107434

Exploitation requires an authenticated low-privilege account (PR:L, i.e. a WordPress 'subscriber'), so the site must permit subscriber registration or the attacker must already hold such an account - this is the primary limiting factor. The target must run the VideoWhisper MicroPayments plugin at version 3.2.9 or earlier. No user interaction and no elevated privileges are needed, and the flaw is network-reachable over the normal WordPress HTTP interface. The scope is unchanged and impact is limited to partial integrity and availability (no confidentiality exposure), so realistic risk is bounded to manipulating payment/entitlement state within the plugin rather than full site compromise.

This is a moderate-risk, not a top-priority, vulnerability based on the available signals. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4) describes a network-reachable, low-complexity flaw requiring low-level authentication (PR:L - consistent with the 'Subscriber Bypass' framing, i.e. a logged-in subscriber escalating or bypassing access controls) with no user interaction, yielding only partial integrity and availability impact and no confidentiality impact. No EPSS score, SSVC decision data, KEV listing, or POC indicator was supplied in the input, so exploitation probability and automatability cannot be quantified from the data given - this is a notable gap. With no KEV entry and no exploit code referenced, there is no public exploit identified at time of analysis, meaning the medium CVSS is driven by the authenticated-but-low-barrier access model rather than by evidence of real-world abuse. CWE-1284 (Improper Validation of Specified Quantity in Input) aligns with the limited, non-confidentiality impact. Net: a legitimate issue worth patching on WordPress sites that allow open subscriber registration, but absent exploitation or EPSS signals it does not rise to emergency priority.

An attacker registers or uses an existing low-privilege subscriber account on a WordPress site running the VideoWhisper MicroPayments plugin (<=3.2.9) and sends crafted requests that the plugin fails to properly validate, bypassing intended payment or access restrictions to reach paid/subscriber-gated functionality. The partial integrity and availability impact suggests the attacker can alter balance/entitlement state or disrupt plugin operation rather than read protected data. No public exploit code is referenced, so exploitation would currently require independent development.