What is the CVSS score of CVE-2026-27053?

CVE-2026-27053 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Broadcast Live Video are affected by CVE-2026-27053?

Broadcast Live Video WordPress plugin versions prior to 7.1.3 contain a critical unauthenticated remote code execution vulnerability (CVSS 9.8) that allows any network-based attacker to achieve…. A patch is available.

How to fix or mitigate CVE-2026-27053?

Within 24 hours: Enumerate all WordPress instances running Broadcast Live Video plugin and record current versions. Within 7 days: Deploy Broadcast Live Video plugin version 7.1.3 or later to all production WordPress installations and perform compatibility testing. Within 30 days: Verify patches applied across staging and development environments, enable Web Application Firewall rules targeting PHP object deserialization attacks, and review access logs for suspicious requests to plugin endpoints.

Broadcast Live Video CVE-2026-27053

EUVD-2026-36913 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-gfh6-hf96-9gf9

PHP Deserialization Broadcast Live Video

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote deserialization in a WordPress plugin endpoint (AV:N/AC:L/PR:N/UI:N); PHP object injection with available gadgets yields full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:40 vuln.today

Patch available

Jun 15, 2026 - 22:32 EUVD

DescriptionCVE.org

Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.

Articles & Coverage 1

News Critical PHP Object Injection in Broadcast Live Video WordPress Plugin - CVE-2026-27053 Jun 16, 2026

AnalysisAI

Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remote attackers to inject crafted serialized PHP objects that are deserialized by the application. With a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and CWE-502 root cause, successful exploitation can lead to remote code execution, data theft, or full site takeover when suitable gadget chains are present in the WordPress stack. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

The affected component is the VideoWhisper Broadcast Live Video plugin for WordPress (CPE cpe:2.3:a:videowhisper.com:broadcast_live_video), a live streaming integration extension. The root cause is CWE-502 (Deserialization of Untrusted Data): user-controllable input is passed into PHP's unserialize() (or equivalent) without integrity checks, allowing attacker-controlled objects to be instantiated. PHP object injection becomes critical when 'magic methods' (__wakeup, __destruct, __toString) in loaded classes - including those from WordPress core, other active plugins, or Composer dependencies - form a 'POP' (Property-Oriented Programming) gadget chain that can be abused to execute arbitrary code, write files, or perform privileged actions in the WordPress context.

RemediationAI

Vendor-released patch: 7.1.3 - upgrade the Broadcast Live Video (VideoWhisper Live Streaming Integration) plugin to version 7.1.3 or later via the WordPress plugin dashboard or by deploying the fixed release from the vendor, per the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/videowhisper-live-streaming-integration/vulnerability/wordpress-broadcast-live-video-plugin-7-1-3-php-object-injection-vulnerability). If immediate patching is not possible, deactivate and remove the plugin until upgrade (loses live streaming functionality), or place the WordPress site behind a WAF with virtual-patching rules from Patchstack/Wordfence that block serialized PHP payloads to plugin endpoints (may cause false positives on legitimate serialized data and does not eliminate root cause). Restricting network access to plugin-exposed AJAX/REST endpoints via IP allowlisting is an additional compensating control where front-end exposure is not required.