EUVD-2026-48176
GHSA-vc92-937c-675m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Arbitrary file deletion enables both integrity and availability impact; A:L added because critical files (wp-config.php) can be deleted, disrupting site operation.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.
AnalysisAI
Unauthenticated arbitrary file deletion in the Broadcast Live Video WordPress plugin (versions <= 7.2.4) allows any remote attacker without credentials to delete arbitrary files on the server by exploiting a path traversal flaw in the plugin's file-handling functionality. Affecting installations of the VideoWhisper live streaming plugin on WordPress, a successful attack can corrupt site integrity - including deletion of critical files such as wp-config.php, effectively bricking the WordPress installation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required per the CVSS vector (PR:N/UI:N), meaning any internet-accessible WordPress installation with this plugin active and version <= 7.2.4 is exploitable without credentials or victim interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 base score of 5.3 (Medium) reflects the limited direct impact encoded in the vector - only Integrity:Low, with Confidentiality:None and Availability:None. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote, unauthenticated attacker identifies a WordPress site running Broadcast Live Video <= 7.2.4 and sends a crafted HTTP request to a plugin endpoint that accepts a file path parameter, supplying a path traversal string (e.g., ../../wp-config.php) to reference a file outside the intended directory. The plugin passes the unsanitized input to a PHP file deletion function, resulting in the targeted file being deleted from the server - potentially rendering the WordPress site inoperable. |
| Remediation | The primary remediation is to update the Broadcast Live Video plugin to a version beyond 7.2.4; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/videowhisper-live-streaming-integration/vulnerability/wordpress-broadcast-live-video-plugin-7-2-4-arbitrary-file-deletion-vulnerability and the WordPress plugin repository for the latest release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Broadcast Live Video
View allUnauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Authenticated code injection in the VideoWhisper Broadcast Live Video WordPress plugin (versions before 7.1.3) lets a hi
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today