VideoWhisper 2Way VideoCalls CVE-2026-110883

Exploitation requires that the vulnerable VideoWhisper '2Way VideoCalls and Random Chat' plugin (webcam-2way-videochat) at version 6.1.5 or earlier be installed and active on a network-reachable WordPress site. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are indicated as prerequisites - the authentication-bypass flaw (CWE-305) is reachable against a standard install. The principal limiting factor is deployment scope: only sites that have specifically installed this niche webcam plugin are affected, and impact is bounded to the low confidentiality/integrity effects scored (no availability impact, no full privilege escalation claimed). The precise feature or endpoint whose authentication is bypassed is not specified in the available description.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5 MEDIUM) describes a remotely exploitable, low-complexity authentication bypass requiring no privileges or user interaction, with low confidentiality and integrity impact and no availability impact. These signals are internally consistent with CWE-305 (Authentication Bypass by Primary Weakness) and the description's 'Authentication Abuse' framing. However, several high-value prioritization signals are entirely ABSENT from the input: there is no EPSS exploitation-probability score, no CISA KEV listing, and no POC indicator provided - so per precision rules this is treated as 'no public exploit identified at time of analysis.' The net picture is a genuine but moderate-severity flaw: network-reachable and unauthenticated, which raises opportunistic-scanning risk for any exposed instance, but bounded to partial confidentiality/integrity impact (not full account takeover or RCE as scored), and affecting a niche WordPress webcam plugin rather than widely-deployed infrastructure. This is a patch-in-normal-cycle issue for the small population running the plugin, not a drop-everything emergency: there is no evidence of active exploitation and the real-world footprint is limited. Note one caveat to verify: the exact mechanism and scope of the authentication abuse are not detailed in the sparse description, so the L/L impact rating cannot be independently corroborated beyond the Patchstack advisory.

A remote, unauthenticated attacker locates a WordPress site running the 2Way VideoCalls and Random Chat plugin (≤6.1.5) and sends requests that bypass the plugin's authentication check to access or abuse video-call functionality intended to be protected. Per the CVSS vector this requires no credentials, no user interaction, and only low attack complexity, making it trivially automatable against exposed endpoints. No public exploit code was identified in the provided data, so exploitation would require independent development of the bypass.