CVE-2026-107429 VideoWhisper.com CVE debrief

Who should care

Defenders responsible for WordPress installations with the Paid Videochat Turnkey Site plugin should assess exposure and prioritize verification and potential updates.

Why it matters

CVE-2026-107429 is a MEDIUM-severity vulnerability in the Paid Videochat Turnkey Site plugin for WordPress, allowing input data manipulation. Defenders responsible for WordPress installations with this plugin should assess exposure, prioritize verification and potential updates, and monitor for suspicious input data manipulation attempts.

• Input data manipulation may lead to unauthorized changes to videochat content or settings.
• Successful exploitation requires low privileges and can be done remotely.
• Defenders should verify input validation mechanisms and update the plugin if necessary.

Technical summary

The Paid Videochat Turnkey Site plugin for WordPress, versions up to and including 7.5.12, is vulnerable to Improper Validation of Specified Quantity in Input, allowing for Input Data Manipulation. The vulnerability has a CVSS score of 4.3 and is considered MEDIUM severity.

Defensive priority

Defenders should prioritize verifying the version of the Paid Videochat Turnkey Site plugin and ensuring it is updated to a version beyond 7.5.12 if possible, as well as monitoring for any suspicious input data manipulation attempts.

Recommended defensive actions

• Verify the version of the Paid Videochat Turnkey Site plugin and update to a version beyond 7.5.12 if possible.
• Monitor for suspicious input data manipulation attempts.
• Review and adjust input validation and sanitization mechanisms in the plugin.

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and affected versions. However, there is limited information on potential exploits or attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.