Broadcast Live Video EUVD-2026-101014

Exploitation targets the plugin's session handling: the attacker must be able to set or predict a session identifier and then get a legitimate user of a WordPress site running VideoWhisper Broadcast Live Video (versions up to and including 7.3.2) to authenticate while that fixed identifier is active. The key limiting factor is victim interaction - the user must log in under the attacker-controlled session for the hijack to succeed - which makes the published UI:N metric questionable. Exploitation also requires that the site actually deploys this specific plugin and exposes the affected authenticated session flow; it does not grant server-level compromise, only takeover of the victim's authenticated session scope.

This is a Session Fixation flaw (CWE-384) in the VideoWhisper 'Broadcast Live Video' WordPress plugin, reported by Patchstack and rated CVSS 7.3 (HIGH) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. No EPSS score, CISA KEV listing, or SSVC decision data was provided in the input, and no public exploit is referenced, so exploitation probability cannot be quantified from the available signals. The CVSS vector claims no user interaction (UI:N), but session fixation attacks almost always require the victim to authenticate using an attacker-supplied/fixed session identifier - this is a notable discrepancy: the published UI:N likely overstates automatability, and realistically UI:R should apply. Verify with vendor/Patchstack. The 'Low' confidentiality/integrity/availability impacts reflect that a successful attack hijacks a single victim's session rather than compromising the server, so the practical blast radius is scoped to the hijacked account's privileges. Net assessment: a legitimate medium-priority web issue (session hijacking against a specific niche plugin), not a widespread wormable threat; the HIGH rating is driven largely by the optimistic UI:N/PR:N metrics rather than evidence of real-world exploitation.

An attacker plants or fixes a known session identifier (e.g., via a crafted link or pre-set cookie) and lures a user of a site running the Broadcast Live Video plugin to authenticate under that identifier. Once the victim logs in, the attacker reuses the now-authenticated fixed session to hijack the victim's session and act as that user. No public proof-of-concept exploit code is referenced in the available data.