What is the CVSS score of CVE-2026-57716?

CVE-2026-57716 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Broadcast Live Video CVE-2026-57716

EUVD-2026-48176 MEDIUM

Path Traversal (CWE-22)

2026-07-23 Patchstack

GHSA-vc92-937c-675m

WordPress Path Traversal Wordpress Plugin Videowhisper Broadcast Live Video

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

6.5 MEDIUM

Arbitrary file deletion enables both integrity and availability impact; A:L added because critical files (wp-config.php) can be deleted, disrupting site operation.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:06 vuln.today

DescriptionCVE.org

Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.

AnalysisAI

Unauthenticated arbitrary file deletion in the Broadcast Live Video WordPress plugin (versions <= 7.2.4) allows any remote attacker without credentials to delete arbitrary files on the server by exploiting a path traversal flaw in the plugin's file-handling functionality. Affecting installations of the VideoWhisper live streaming plugin on WordPress, a successful attack can corrupt site integrity - including deletion of critical files such as wp-config.php, effectively bricking the WordPress installation. No public exploit code or KEV listing has been identified at time of analysis, but the zero-authentication barrier lowers the practical difficulty considerably.

Technical ContextAI

The affected product is the Broadcast Live Video plugin for WordPress, developed by VideoWhisper (CPE: cpe:2.3:a:videowhisper:broadcast_live_video:*:*:*:*:*:*:*:*), which provides live video streaming and broadcasting integration for WordPress sites. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., Path Traversal). This class of vulnerability arises when user-supplied input - such as a filename or path parameter - is concatenated into a filesystem operation (here, a file deletion call) without sufficient sanitization or canonical-path validation, allowing sequences like '../../../' to escape the intended directory boundary and reference arbitrary filesystem paths. Because the CVSS vector is PR:N/UI:N, the vulnerable code path is reachable by any HTTP client without authentication or interaction.

RemediationAI

The primary remediation is to update the Broadcast Live Video plugin to a version beyond 7.2.4; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/videowhisper-live-streaming-integration/vulnerability/wordpress-broadcast-live-video-plugin-7-2-4-arbitrary-file-deletion-vulnerability and the WordPress plugin repository for the latest release. No specific patched version number has been confirmed from the available data - verify the exact fix version with the vendor before deploying. If an immediate update is not possible, consider deactivating the plugin entirely as a compensating control, accepting the trade-off of losing live streaming functionality. Additionally, applying a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (e.g., ../ or encoded variants) targeting the plugin's endpoints can reduce exploitation risk, though this should not substitute for patching.