CVE-2026-107421: VideoWhisper Session Fixation Vulnerability

CVE-2026-107421 Overview

CVE-2026-107421 is a session fixation vulnerability in the VideoWhisper.com Broadcast Live Video plugin (videowhisper-live-streaming-integration) for WordPress. The flaw affects all plugin versions up to and including 7.3.2. An attacker can fix a known session identifier on a victim and reuse it after authentication, enabling session hijacking against streaming hosts and viewers. The weakness is categorized under CWE-384: Session Fixation.

Critical Impact
Remote attackers can hijack authenticated WordPress sessions on sites running the Broadcast Live Video plugin, gaining access to streaming controls and user-scoped data without credentials.

Affected Products

VideoWhisper Broadcast Live Video plugin for WordPress
Plugin slug: videowhisper-live-streaming-integration
All versions from n/a through 7.3.2

Discovery Timeline

2026-10-14 - CVE-2026-107421 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107421

Vulnerability Analysis

The plugin fails to regenerate a user's session identifier at authentication boundaries. When a session ID remains constant across the pre-authentication and post-authentication states, an attacker who plants a chosen session identifier in a victim's browser inherits that same session once the victim logs in. The outcome is full reuse of the victim's authenticated context within the WordPress site.

Session fixation differs from session hijacking by theft. Here the attacker supplies the session identifier up front, typically via a crafted link, a cross-site injection, or a shared network vector, then waits for the victim to authenticate against that fixed identifier.

The vulnerability requires no privileges and no user interaction beyond normal login. It is exploitable over the network against any site exposing the vulnerable plugin.

Root Cause

The root cause is missing session renewal logic. Secure session handling in WordPress plugins requires invalidating any existing session cookie and issuing a fresh identifier on privilege transitions, especially login. The Broadcast Live Video plugin preserves the pre-login session identifier, violating CWE-384.

Attack Vector

An attacker first obtains or sets a valid session identifier on the target site. The attacker then delivers that identifier to the victim through a crafted URL parameter, a cookie set via an adjacent XSS sink, or a shared browser context. When the victim authenticates to WordPress, the plugin retains the fixed identifier. The attacker reuses the same cookie to act as the authenticated user, accessing broadcasting controls, chat moderation, and account-scoped functions.

Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-107421

Indicators of Compromise

Multiple distinct source IP addresses or user-agent strings reusing the same WordPress session cookie (wordpress_logged_in_*) within a short window.
Session cookies that persist unchanged across a user's login event in web server or reverse-proxy logs.
Unexpected broadcast start, stop, or configuration events in VideoWhisper plugin logs tied to accounts without matching login activity from the same IP.

Detection Strategies

Correlate authentication events with session identifier values. Flag any login where the post-authentication session cookie matches a pre-authentication value.
Alert on concurrent use of a single session identifier from geographically or network-dispersed sources.
Baseline normal cookie rotation behavior for the site and alert on sessions that outlive expected lifetimes.

Monitoring Recommendations

Enable verbose access logging on the WordPress front controller and capture Cookie and Set-Cookie headers through a reverse proxy or WAF.
Ingest WordPress authentication logs into a centralized data lake and retain them for correlation with web traffic.
Monitor the wp-content/plugins/videowhisper-live-streaming-integration/ directory for unexpected file modifications that may indicate follow-on activity after a hijack.

How to Mitigate CVE-2026-107421

Immediate Actions Required

Audit WordPress sites for the presence of the videowhisper-live-streaming-integration plugin at version 7.3.2 or earlier.
Force invalidation of all active WordPress sessions by rotating authentication salts in wp-config.php, which forces every user to re-authenticate.
Review administrator and streamer accounts for unauthorized configuration changes made since the plugin was installed.

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry. Consult the Patchstack Vulnerability Report and the VideoWhisper plugin page for an updated release addressing CVE-2026-107421.

Workarounds

Disable or remove the Broadcast Live Video plugin until a patched version is available.
Deploy a web application firewall rule that strips attacker-controlled session cookies on unauthenticated requests to WordPress login endpoints.
Enforce the HttpOnly, Secure, and SameSite=Lax attributes on all WordPress session cookies at the reverse proxy to reduce the fixation attack surface.
Require two-factor authentication for all privileged WordPress accounts to limit the value of a hijacked session.

bash

# Rotate WordPress authentication salts to invalidate all active sessions.
# Replace the AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY and
# matching *_SALT values in wp-config.php with fresh values from:
#   https://api.wordpress.org/secret-key/1.1/salt/

# Example: fetch and preview new salts
curl -s https://api.wordpress.org/secret-key/1.1/salt/

# After editing wp-config.php, verify no stale sessions remain
wp user session destroy --all --allow-root