Broadcast Live Video CVE-2026-108475

Exploitation requires an authenticated WordPress account with at least low privileges (PR:L) on a site running the VideoWhisper Broadcast Live Video plugin version 7.3.6 or earlier; the flaw is a missing/incorrectly-configured authorization check on a plugin function, so the attacker leverages their existing low-level session to invoke an action they should not be entitled to. Limiting factors: the attacker cannot be fully anonymous (an account is needed, which on sites allowing open registration is a low bar), impact is restricted to integrity only (no data disclosure or denial of service), scope is unchanged, and the site must have this specific plugin installed and enabled.

This is a medium-severity (CVSS 4.3) missing-authorization flaw whose signals consistently point to LOW real-world priority rather than an urgent threat. The provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) shows it is network-reachable with low attack complexity and no user interaction, but it REQUIRES an authenticated low-privileged account (PR:L) and yields only limited integrity impact (I:L) with no confidentiality or availability loss. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. There is no CISA KEV listing and no public exploit referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data (automatable / technical impact) was provided. The signals are internally consistent - there is no conflict between the CVSS vector and the Broken Access Control description - so the assessment is that this is a genuine but low-urgency authorization weakness, not a high-impact priority. Note the input tag 'Authentication Bypass' is imprecise: PR:L confirms the attacker must already be authenticated, so this is broken access control / privilege misuse, not an authentication bypass.

An attacker who holds a low-privileged WordPress account (e.g., a self-registered subscriber) on a site running Broadcast Live Video ≤7.3.6 sends a request to a plugin action or endpoint that lacks a proper capability/authorization check. Because the authorization control is missing or misconfigured, the request succeeds and the attacker performs an action reserved for higher-privileged users, producing a limited integrity change. No public proof-of-concept was referenced in the provided data.