CVE-2026-107426: Paid Videochat Authorization Bypass Flaw

CVE-2026-107426 is an authorization bypass flaw in VideoWhisper Paid Videochat Turnkey Site affecting versions up to 7.5.12. Attackers can exploit misconfigured access controls to gain unauthorized access. This article covers technical details, affected versions, security impact, and recommended mitigation strategies.

CVE-2026-107426 Overview

CVE-2026-107426 is a missing authorization vulnerability in the VideoWhisper.com Paid Videochat Turnkey Site (ppv-live-webcams) WordPress plugin. The flaw affects all versions up to and including 7.5.12. Unauthenticated attackers can exploit incorrectly configured access control security levels to interact with plugin functionality that should require authentication or elevated privileges. The weakness is tracked under CWE-862: Missing Authorization.

Critical Impact
Remote attackers can bypass access controls over the network without authentication or user interaction, affecting confidentiality, integrity, and availability of the WordPress site.

Affected Products

VideoWhisper.com Paid Videochat Turnkey Site (ppv-live-webcams) WordPress plugin
All versions from unspecified initial release through 7.5.12
WordPress installations running the vulnerable plugin

Discovery Timeline

2026-10-14 - CVE-2026-107426 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107426

Vulnerability Analysis

The plugin exposes functionality without properly verifying that the requesting user holds the required authorization. Access control checks are either absent or misconfigured on sensitive endpoints. Attackers reach these endpoints directly over HTTP, bypassing the plugin's intended permission model.

Broken access control in WordPress plugins typically allows unauthenticated callers to invoke privileged AJAX actions, REST routes, or admin handlers. The result is unauthorized data access, state modification, or disruption of plugin services supporting live videochat sessions and pay-per-view workflows.

Root Cause

The root cause is a missing authorization check [CWE-862]. The plugin fails to validate the capability or role of the requester before executing protected operations. Functions that should be gated by current_user_can(), nonce verification, or role-based access checks are reachable without those controls.

Attack Vector

An attacker sends crafted HTTP requests to the vulnerable plugin endpoints on a WordPress site exposing ppv-live-webcams version 7.5.12 or earlier. No credentials, user interaction, or elevated privileges are required. Exploitation can be fully automated against internet-facing WordPress installations.

Technical details are described in the Patchstack advisory. No verified public proof-of-concept code is available at the time of publication.

Detection Methods for CVE-2026-107426

Indicators of Compromise

Unauthenticated HTTP POST or GET requests to /wp-admin/admin-ajax.php referencing ppv-live-webcams or VideoWhisper actions
Requests to plugin REST endpoints under /wp-json/ associated with ppv-live-webcams from unknown source IPs
Unexpected changes to plugin configuration, user records, or payment-related data without a corresponding admin login event

Detection Strategies

Review web server access logs for repeated unauthenticated calls to plugin handlers that normally require login
Correlate anomalous admin-ajax activity with the absence of valid WordPress session cookies
Monitor the WordPress database for unauthorized record creation or modification tied to the plugin's tables

Monitoring Recommendations

Enable verbose logging on the WordPress site, including authentication events and plugin AJAX calls
Forward web and application logs to a centralized analytics platform for behavioral baselining
Alert on spikes in 200-OK responses to plugin endpoints originating from a narrow set of IPs

How to Mitigate CVE-2026-107426

Immediate Actions Required

Identify all WordPress sites running the ppv-live-webcams plugin and confirm installed versions
Disable the plugin on affected sites until a patched release is installed
Restrict administrative and AJAX endpoints behind a web application firewall (WAF) with rules that block unauthenticated access to plugin actions

Patch Information

At the time of publication, the advisory lists affected versions through 7.5.12. Monitor the Patchstack advisory and the plugin's WordPress.org page for the fixed release and upgrade immediately once available.

Workarounds

Deploy WAF rules that block requests to the plugin's AJAX and REST endpoints from unauthenticated sessions
Remove or deactivate the plugin if the videochat functionality is not business-critical
Place the WordPress admin interface behind IP allowlisting or an authenticated reverse proxy

bash

# Example: block unauthenticated access to the plugin's admin-ajax actions at the web server
# nginx snippet
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "(ppv|videowhisper)") {
        # require a valid WordPress logged-in cookie
        if ($http_cookie !~* "wordpress_logged_in_") {
            return 403;
        }
    }
}