Broadcast Live Video EUVD-2026-112728

Exploitation requires the target WordPress site to run the VideoWhisper Broadcast Live Video plugin at version 7.3.9 or earlier, and the attacker must already hold a valid low-privilege account on that site (CVSS PR:L) - so sites that permit open/self-service user registration are most exposed, while sites with closed registration sharply limit the attacker pool. No user interaction is needed (UI:N) and the vector is network-reachable (AV:N). The available sources do not name the specific plugin feature, endpoint, or configuration setting whose access control is misconfigured, so beyond the authenticated-account prerequisite the exact enabling condition is not described.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, base 7.1) describes a network-reachable, low-complexity flaw that requires an authenticated low-privilege account (PR:L) and no user interaction, with no confidentiality impact but low integrity and high availability impact - consistent with a subscriber/low-role user triggering actions they should not be authorized to perform (CWE-862 Missing Authorization). The vuln.today decision label is 'this_week' (not act_now/emergency), and the issue is not listed in CISA KEV, so there is no evidence of active exploitation. No EPSS score was supplied, so exploitation probability cannot be quantified here. The only reference is the Patchstack vulnerability database entry, which is an advisory record rather than a verified working exploit, so no public exploit code is established. On balance this is a moderate, authenticated access-control issue in a niche WordPress plugin: real enough to patch on a near-term schedule as the 'this_week' label suggests, but not a widespread or actively exploited emergency. Note that PR:L requires attackers to already hold a valid (even if minimal) account on the target site, which meaningfully limits mass exploitation against sites that do not allow open registration.

An attacker who holds a low-privilege WordPress account (e.g., a self-registered subscriber on a site using the Broadcast Live Video plugin) sends a request to a plugin function that fails to verify the caller's authorization. Because access control is incorrectly configured, the request succeeds and lets the attacker alter plugin state or disrupt the streaming service beyond their intended role. No public exploit code has been identified, and the precise function and request needed to trigger the flaw are not described in the available sources.