What is the CVSS score of CVE-2026-57331?

CVE-2026-57331 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Paid Videochat Turnkey Site are affected by CVE-2026-57331?

The VideoWhisper Paid Videochat Turnkey Site WordPress plugin (versions 7.4.8 and below) allows authenticated performer accounts to delete arbitrary WordPress files, including critical configuration…

How to fix or mitigate CVE-2026-57331?

Within 24 hours: Inventory all WordPress installations running VideoWhisper plugin version 7.4.8 or earlier and immediately deactivate the affected plugin. Remove or suspend all non-essential low-privilege performer accounts. Within 7 days: Review WordPress and server audit logs for suspicious file deletion activity; audit file system permissions to restrict WordPress process write access to minimal necessary directories. Within 30 days: Evaluate migration to alternative video hosting solutions or establish vendor contact for patch availability timeline; implement granular role-based access controls to limit performer capabilities to essential functions only.

Paid Videochat Turnkey Site CVE-2026-57331

EUVD-2026-40102 CRITICAL

Path Traversal (CWE-22)

2026-06-29 Patchstack

GHSA-752c-x542-h98f

WordPress Path Traversal Wordpress Plugin Videowhisper Paid Videochat Turnkey Site

9.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Network-reachable endpoint needs only a low-privilege Performer account (PR:L, AC:L); arbitrary deletion gives high integrity/availability impact and scope change, but no read primitive so C:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 15:17 vuln.today

DescriptionCVE.org

Performer Arbitrary File Deletion in Paid Videochat Turnkey Site <= 7.4.8 versions.

AnalysisAI

Arbitrary file deletion in the VideoWhisper Paid Videochat Turnkey Site WordPress plugin (versions <= 7.4.8) lets an authenticated low-privilege 'Performer' account delete files outside the intended directory via path traversal. Because deleting critical WordPress files such as wp-config.php can force the site into setup mode and enable full takeover, the impact crosses a security boundary (scope change) and is rated CVSS 9.9. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected software is a WordPress plugin published by VideoWhisper (CPE cpe:2.3:a:videowhisper:paid_videochat_turnkey_site, plugin slug ppv-live-webcams) that provides paid live videochat/webcam functionality with a 'Performer' user role. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal): a file-handling routine accepts an attacker-influenced path or filename without properly canonicalizing or constraining it to a safe base directory, so '../' sequences (or absolute paths) reach files outside the plugin's intended storage. This class of flaw in PHP/WordPress plugins typically appears in upload-management or media-cleanup endpoints where a user-supplied parameter is passed to unlink() or a similar deletion call.

RemediationAI

No vendor-released patch version was identified in the provided data; the input confirms only that versions <= 7.4.8 are vulnerable. Administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-plugin-7-4-8-arbitrary-file-deletion-vulnerability) and update to the next release above 7.4.8 once VideoWhisper publishes one, verifying the fixed version with the vendor before relying on it. Until a confirmed patched build is installed, reduce exposure by restricting who can obtain a 'Performer' account (disable open performer self-registration and manually vet performers), placing the plugin's endpoints behind a WAF rule that blocks path-traversal sequences ('../', encoded variants, absolute paths) in request parameters, and applying least-privilege filesystem permissions so the web server user cannot delete WordPress core files such as wp-config.php. If the feature is non-essential, deactivating the plugin removes the risk entirely at the cost of losing videochat functionality; tightening registration and WAF filtering preserves functionality but provides weaker assurance than a vendor patch.