CVE-2026-108475
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Broadcast Live Video plugin by VideoWhisper.com up to version 7.3.6 contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.
Risk Assessment
An attacker may gain unauthorized access to protected functions, potentially leading to data breaches or unauthorized actions.
Recommendation
Update the plugin to the latest version if available and review access control configuration to ensure security levels are properly set.
Other vulnerabilities in Broadcast Live Video
See all- CVE-2026-57716Medium
Broadcast Live Video plugin version 7.2.4 and earlier allows an unauthenticated attacker to arbitrarily delete files. The attacker can delete critical system files.
- CVE-2026-27053Critical
In Broadcast Live Video versions below 7.1.3, there is a vulnerability to unauthenticated PHP object injection.
- CVE-2026-24937High
The Broadcast Live Video plugin by VideoWhisper.Com for WordPress before version 7.1.3 contains a Code Injection vulnerability. This allows an attacker to inject and execute arbitrary code.
Original NVD description (English source)
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS