Broadcast Live Video EUVD-2026-104251

The target must run the VideoWhisper Broadcast Live Video WordPress plugin at version 7.3.7 or earlier, which is reachable over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, elevated privileges, or user interaction is required, so default installations are exposed. The primary limiting factors are the narrow real-world footprint of this specific plugin and the confidentiality-only impact (C:L/I:N/A:N) - successful exploitation yields unauthorized access to restricted data/functions but no data modification or service disruption; exact prerequisites (which specific endpoint/action lacks the check) are not detailed in the available advisory.

This is a moderate-severity Missing Authorization flaw (CWE-862) with a CVSS 3.1 base score of 5.3. The vector (AV:N/AC:L/PR:N/UI:N) indicates remote, low-complexity, unauthenticated exploitation requiring no user interaction, which raises its theoretical reachability. However, impact is strictly limited to confidentiality (C:L/I:N/A:N) - an attacker can read or access data they should not, but cannot modify data or disrupt availability. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active exploitation or weaponization; the signals are consistent with a low-urgency information-disclosure/access-control gap rather than a critical priority. The only intelligence source is a single Patchstack advisory, so corroboration is thin. Net assessment: real but low-to-moderate priority - patch during normal maintenance unless the affected plugin handles sensitive stream data.

A remote, unauthenticated attacker sends crafted HTTP requests to a WordPress site running the Broadcast Live Video plugin (≤7.3.7), invoking a plugin endpoint or action that lacks a proper capability/authorization check. Because of the missing access-control check, the attacker reads or reaches functionality or data intended only for authorized users. No public exploit code is identified at time of analysis.