CVE-2026-24590
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Paid Videochat Turnkey Site plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. Versions up to 7.3.23 are affected.
Risk Assessment
An attacker can gain unauthorized access to administrative functions or sensitive data, potentially leading to site compromise.
Recommendation
Update the plugin to the latest available version or apply appropriate patches.
Other vulnerabilities in Paid Videochat Turnkey Site
See all- CVE-2026-57331Critical
The Performer Arbitrary File Deletion vulnerability in Paid Videochat Turnkey Site versions up to 7.4.8 allows an attacker to delete arbitrary files on the server. This flaw can be exploited to remove critical system or application files.
- CVE-2026-27333High
Paid Videochat Turnkey Site versions up to 7.3.23 are vulnerable to unauthenticated deserialization of untrusted data.
Original NVD description (English source)
Missing Authorization vulnerability in VideoWhisper.Com Paid Videochat Turnkey Site allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Paid Videochat Turnkey Site: from n/a through 7.3.23.