CVE-2026-107426 VideoWhisper.com CVE debrief

Who should care

Administrators and security teams responsible for WordPress installations with the Paid Videochat Turnkey Site plugin should be aware of this vulnerability. Given the HIGH severity rating, immediate verification of the plugin version and consideration of updates or patches is recommended.

Why it matters

CVE-2026-107426 is a Broken Access Control vulnerability in the Paid Videochat Turnkey Site plugin for WordPress. It has a CVSS score of 7.3 and a HIGH severity rating. The vulnerability arises from missing authorization, allowing for exploitation of incorrectly configured access control security levels. Defenders should verify the plugin version, assess exposure, and prioritize remediation.

• Verification of plugin version and potential updates is required to mitigate this vulnerability.
• Improperly configured access control could lead to unauthorized access or manipulation of plugin functionality.
• Defenders should assess exposure and prioritize remediation due to the HIGH severity rating and CVSS score of 7.3.

Technical summary

The Paid Videochat Turnkey Site plugin for WordPress, versions up to and including 7.5.12, is vulnerable to a Broken Access Control issue. This vulnerability is due to missing authorization in the plugin, which could allow for exploitation of incorrectly configured access control security levels. The CVSS score for this vulnerability is 7.3, indicating a HIGH severity rating.

Defensive priority

Defenders should prioritize verifying the version of the Paid Videochat Turnkey Site plugin in use and ensuring it is updated to a version beyond 7.5.12 if possible. Given the HIGH severity and CVSS score of 7.3, immediate attention is warranted for systems utilizing this plugin.

Recommended defensive actions

• Verify the version of the Paid Videochat Turnkey Site plugin and update to a version beyond 7.5.12 if possible.
• Review access control configurations for the plugin to ensure they are properly set up.
• Monitor for any suspicious activity related to the plugin.

Evidence notes

The evidence provided indicates a vulnerability in the Paid Videochat Turnkey Site plugin for WordPress, specifically versions up to and including 7.5.12. The CVE Program and NVD have records of this vulnerability, confirming its existence and providing CVSS metrics.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.