What is the CVSS score of CVE-2026-27333?

CVE-2026-27333 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Paid Videochat Turnkey Site are affected by CVE-2026-27333?

The Paid Videochat Turnkey Site WordPress plugin (ppv-live-webcams) versions 7.3.23 and earlier contains an unauthenticated PHP object injection vulnerability (CVSS 8.1) that allows remote attackers…

How to fix or mitigate CVE-2026-27333?

Within 24 hours: Inventory all WordPress installations running Paid Videochat Turnkey Site / ppv-live-webcams plugin at versions 7.3.23 or earlier. Within 7 days: Either deactivate and remove the plugin (preferred) or isolate affected WordPress instances to minimize attack surface. Within 30 days: Monitor Patchstack advisory (EUVD-2026-36915) and plugin repository for patch release; plan immediate deployment upon availability.

Paid Videochat Turnkey Site CVE-2026-27333

EUVD-2026-36915 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-7jqc-9jj9-67rh

WordPress Deserialization Wordpress Plugin Paid Videochat Turnkey Site Videowhisper Com

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network-reachable PHP deserialization yields PR:N/AV:N with full CIA impact; AC:H reflects dependence on an available gadget chain for reliable code execution.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:39 vuln.today

DescriptionCVE.org

Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions.

AnalysisAI

Unauthenticated PHP object injection in the Paid Videochat Turnkey Site WordPress plugin (versions 7.3.23 and earlier, also marketed as 'ppv-live-webcams') allows remote attackers to deserialize untrusted data and potentially achieve full compromise of the underlying site. The flaw was reported by Patchstack and tracked as EUVD-2026-36915; no public exploit code or CISA KEV listing is identified at time of analysis, though the CVSS 8.1 score reflects confidentiality, integrity, and availability impact gated by high attack complexity.

Technical ContextAI

The affected component is a WordPress plugin distributed by videowhisper.com (CPE cpe:2.3:a:videowhisper.com:paid_videochat_turnkey_site) that powers pay-per-view live webcam sites. The root cause is CWE-502 (Deserialization of Untrusted Data), meaning the plugin passes attacker-controllable input into PHP's unserialize() or an equivalent routine without sufficient validation. In WordPress ecosystems, such flaws are typically chainable with 'POP gadgets' present in WordPress core, common libraries, or other installed plugins, allowing object instantiation that leads to file writes, SQL execution, or remote code execution.

RemediationAI

No vendor-released patched version is independently confirmed in the supplied data, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-plugin-7-3-23-deserialization-of-untrusted-data-vulnerability) and the NVD entry for the most current fixed release and upgrade beyond 7.3.23 as soon as one is published. Until a patched version is installed, deactivate and remove the ppv-live-webcams plugin if the videochat functionality is non-essential, or place the affected WordPress site behind a WAF rule that blocks serialized PHP payloads (strings beginning with 'O:', 'a:', 'C:' in request bodies and query parameters) targeting the plugin's endpoints - accepting that aggressive WAF rules can break legitimate POST data containing similar tokens. Additionally, restrict access to the plugin's request handlers via IP allowlisting at the web server level for trusted administrators only, with the trade-off of disabling public webcam purchases until the patch lands.