What is the CVSS score of CVE-2026-24590?

CVE-2026-24590 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Paid Videochat Turnkey Site CVE-2026-24590

EUVD-2026-31806 MEDIUM

Missing Authorization (CWE-862)

2026-05-26 Patchstack

GHSA-vqrw-78h5-gqqr

WordPress Authentication Bypass Wordpress Plugin Paid Videochat Turnkey Site Videowhisper Com

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:54 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in VideoWhisper.Com Paid Videochat Turnkey Site allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Paid Videochat Turnkey Site: from n/a through 7.3.23.

AnalysisAI

Unauthenticated access control bypass in VideoWhisper.Com's Paid Videochat Turnkey Site WordPress plugin (versions through 7.3.23) allows remote attackers to access restricted resources without authorization, resulting in partial information disclosure. The plugin (known by slug ppv-live-webcams) fails to enforce authorization checks on one or more endpoints, enabling any unauthenticated network actor to exploit incorrectly configured access control security levels. No public exploit code has been identified and CISA KEV does not list this vulnerability, though SSVC data confirms the attack is automatable, raising the potential for scripted mass scanning.

Technical ContextAI

The affected product is a WordPress plugin (CPE: cpe:2.3:a:videowhisper.com:paid_videochat_turnkey_site:*:*:*:*:*:*:*:*) that provides paid live videochat and webcam functionality for WordPress-based sites. The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints or AJAX handlers fail to verify that the requesting user holds the appropriate capability or role before returning data or performing an action. In WordPress, this class of flaw typically arises when developers register REST API routes or wp-ajax hooks without attaching a permission_callback, or when that callback always returns true. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms the flaw is remotely exploitable with no prerequisites, but impact is limited to low-severity confidentiality exposure with no integrity or availability consequence.

RemediationAI

The primary recommended action is to update the Paid Videochat Turnkey Site plugin to a version beyond 7.3.23. A specific patched release version has not been independently confirmed from the available intelligence data; administrators should consult the plugin's WordPress.org page or the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-plugin-7-3-23-broken-access-control-vulnerability-2) for the exact fixed release. If an update is not immediately available, a compensating control is to restrict access to the WordPress installation's AJAX and REST API endpoints at the web server or WAF layer, limiting access to authenticated sessions only - note this may break legitimate unauthenticated plugin functionality such as public videochat widgets. Additionally, monitoring for anomalous unauthenticated requests to wp-admin/admin-ajax.php or /wp-json/ endpoints can surface exploitation attempts. Disabling the plugin entirely until patched is the most conservative interim option.