EUVD-2026-97576
GHSA-q36f-mphr-fcg3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege WordPress account
-
ExploitSend crafted request to plugin endpoint
-
ExecutionBypass missing authorization check
-
ImpactAccess out-of-scope data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated low-privilege account on the target site (CVSS PR:L), so it is not usable by fully unauthenticated attackers; the flaw is a missing authorization check in the Paid Videochat Turnkey Site (ppv-live-webcams) plugin affecting all versions up to and including 7.5.13. No user interaction is needed (UI:N) and no special non-default configuration is indicated by the available data, but the limiting factor is the requirement to first hold a valid low-privilege session on a site running the vulnerable plugin version; impact is limited to confidentiality disclosure (C:L, I:N, A:N). |
| Impact | This is a moderate, not high-priority, issue. The CVSS 3.1 base score is 5.0 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - network-reachable and low-complexity, but requiring an already-authenticated low-privilege account (PR:L) and yielding only limited confidentiality impact with no integrity or availability impact. CWE-862 (Missing Authorization) aligns with the Patchstack classification of 'Broken Access Control,' and the scope change (S:C) indicates the access-control gap lets a low-privileged user reach resources beyond their authorization boundary. No EPSS score, CISA KEV listing, or public POC was supplied in the input, so exploitation likelihood cannot be quantified from the available signals. The signals are internally consistent (authenticated, limited-impact authorization flaw) and point to no public exploit identified at time of analysis; the realistic risk is low-to-moderate and gated by the attacker first obtaining a valid low-privilege WordPress account on an affected site. |
| Exploit ScenarioDerived | An attacker who holds a low-privilege account (e.g., a registered/subscriber user) on a WordPress site running the Paid Videochat Turnkey Site plugin ≤7.5.13 sends a crafted authenticated request to a plugin endpoint that fails to verify the caller's authorization level. Because of the missing authorization check, the request returns or acts on data the user should not be able to reach, disclosing limited sensitive information. No public exploit code was identified in the provided data, and exploitation requires a pre-existing authenticated session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Missing authorization in the WordPress plugin Paid Videochat Turnkey Site (ppv-live-webcams, versions through 7.5.13) lets an attacker who already holds a low-privilege account on the site bypass the plugin's access-control checks and read information that should be restricted to higher-privileged users. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N, score 5.0) confirms it is remotely reachable, requires no user interaction, and is limited to a confidentiality disclosure of low severity, with no integrity or availability impact; the scope change (S:C) reflects that the weakness lets the attacker reach resources beyond the plugin component itself. Exploitation status is no public exploit identified at time of analysis - there is no KEV listing and no published proof-of-concept code - and the practical prerequisite is that the attacker must first register or otherwise obtain a low-privilege session on a site running the vulnerable version.
RemediationAI
No vendor-released patch identified at time of analysis for CVE-2026-108476: neither the advisory nor the supplied references disclose a fixed plugin version, so administrators cannot yet upgrade past the vulnerable build by version number and should instead reduce exposure directly. The primary actionable control is to restrict who can hold an account on the affected site - disable open/public user registration, audit existing low-privilege roles, and remove or downgrade accounts that do not need access - because the flaw requires PR:L, i.e. a valid low-privilege session, and closing that prerequisite neutralizes the exploit path; the trade-off is loss of self-service signup and possible disruption to legitimate paying users. If the site does not actively use pay-per-view videochat features, deactivate the ppv-live-webcams plugin until a patched release appears, accepting the loss of that functionality. Where the plugin must stay live, add targeted compensating controls: block or rate-limit direct requests to the plugin's AJAX/REST/admin-post endpoints from users lacking the intended capabilities, and deploy a WAF rule set that rejects unauthenticated or low-privilege calls to those paths, recognizing that such rules are signature-based and may miss alternate routes or be bypassed by parameter variation. Monitor plugin directory and vendor channels and apply the official update as soon as it is published; in the interim, review server and application logs for unexpected enumeration or data retrieval by low-privilege accounts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress plugin, Paid Videochat Turnkey Site, published under the slug ppv-live-webcams by VideoWhisper.com, which provides pay-per-view live webcam/videochat functionality. The flaw is classified as CWE-862 (Missing Authorization), a root-cause class in which a function or endpoint fails to perform the capability/permission check that its functionality requires - commonly a WordPress AJAX, REST, or admin-post handler that verifies the user is logged in (or even skips that) but never calls current_user_can() or an equivalent nonce/capability gate before returning data. Because the plugin handles configuration and content intended for site administrators and paying/privileged users, omitting that check exposes those resources to any account that can reach the endpoint. The Patchstack report tags the issue as an authentication bypass / incorrectly configured access-control level. The CVSS scope change (S:C) indicates the impacted security authority extends beyond the vulnerable plugin, while the low confidentiality rating (C:L) and absent integrity/availability impact indicate the observable result is disclosure of limited information rather than data modification or service disruption. No CPE identifiers were supplied in the available data, so exact affected builds are defined solely by the plugin's version range.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Network-reachable authorization flaw needing a low-privilege account (PR:L), crossing the authorization boundary (S:C) with only limited confidentiality disclosure and no integrity or availability impact.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
DescriptionCVE.org
Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.13.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB