EUVD-2026-36915
GHSA-7jqc-9jj9-67rh
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable PHP deserialization yields PR:N/AV:N with full CIA impact; AC:H reflects dependence on an available gadget chain for reliable code execution.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions.
AnalysisAI
Unauthenticated PHP object injection in the Paid Videochat Turnkey Site WordPress plugin (versions 7.3.23 and earlier, also marketed as 'ppv-live-webcams') allows remote attackers to deserialize untrusted data and potentially achieve full compromise of the underlying site. The flaw was reported by Patchstack and tracked as EUVD-2026-36915; no public exploit code or CISA KEV listing is identified at time of analysis, though the CVSS 8.1 score reflects confidentiality, integrity, and availability impact gated by high attack complexity.
Technical ContextAI
The affected component is a WordPress plugin distributed by videowhisper.com (CPE cpe:2.3:a:videowhisper.com:paid_videochat_turnkey_site) that powers pay-per-view live webcam sites. The root cause is CWE-502 (Deserialization of Untrusted Data), meaning the plugin passes attacker-controllable input into PHP's unserialize() or an equivalent routine without sufficient validation. In WordPress ecosystems, such flaws are typically chainable with 'POP gadgets' present in WordPress core, common libraries, or other installed plugins, allowing object instantiation that leads to file writes, SQL execution, or remote code execution.
RemediationAI
No vendor-released patched version is independently confirmed in the supplied data, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-plugin-7-3-23-deserialization-of-untrusted-data-vulnerability) and the NVD entry for the most current fixed release and upgrade beyond 7.3.23 as soon as one is published. Until a patched version is installed, deactivate and remove the ppv-live-webcams plugin if the videochat functionality is non-essential, or place the affected WordPress site behind a WAF rule that blocks serialized PHP payloads (strings beginning with 'O:', 'a:', 'C:' in request bodies and query parameters) targeting the plugin's endpoints - accepting that aggressive WAF rules can break legitimate POST data containing similar tokens. Additionally, restrict access to the plugin's request handlers via IP allowlisting at the web server level for trusted administrators only, with the trade-off of disabling public webcam purchases until the patch lands.
More in Paid Videochat Turnkey Site
View allArbitrary file deletion in the VideoWhisper Paid Videochat Turnkey Site WordPress plugin (versions <= 7.4.8) lets an aut
Unauthenticated access control bypass in VideoWhisper.Com's Paid Videochat Turnkey Site WordPress plugin (versions throu
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today