CVE-2026-108475 Overview
CVE-2026-108475 is a Missing Authorization vulnerability in the VideoWhisper.com Broadcast Live Video plugin (videowhisper-live-streaming-integration) for WordPress. The flaw stems from incorrectly configured access control security levels. It affects all plugin versions up to and including 7.3.6. An authenticated attacker with low-level privileges can send requests to protected plugin endpoints and perform actions that should require higher authorization. The weakness is tracked under CWE-862: Missing Authorization.
Critical Impact
Low-privileged authenticated users can bypass access control checks on the Broadcast Live Video plugin and modify data integrity-affecting state without proper authorization.
Affected Products
- VideoWhisper.com Broadcast Live Video (videowhisper-live-streaming-integration) plugin for WordPress
- All plugin versions from n/a through 7.3.6
- WordPress sites running the vulnerable plugin with multiple user roles enabled
Discovery Timeline
- 2026-10-12 - CVE-2026-108475 published to the National Vulnerability Database
- 2026-10-13 - Entry last modified in the NVD
Technical Details for CVE-2026-108475
Vulnerability Analysis
The Broadcast Live Video plugin exposes functionality that lacks proper authorization checks. A plugin action can be invoked by any authenticated session, including low-privileged subscriber-level accounts, instead of being restricted to administrators or broadcaster roles. The attack is remote, requires low attack complexity, and needs only an authenticated session with limited privileges. User interaction is not required. The resulting impact is limited to integrity; confidentiality and availability are unaffected according to the published CVSS vector.
Root Cause
The root cause is a missing capability or nonce check inside one or more plugin handlers. WordPress plugins should wrap privileged actions with current_user_can() checks and verify request origin with check_admin_referer() or wp_verify_nonce(). The affected plugin paths do neither on at least one handler, allowing any logged-in user to reach code intended for privileged roles. This classifies as broken access control under CWE-862.
Attack Vector
An attacker first obtains any authenticated WordPress account on the target site, including self-registered subscriber accounts if open registration is enabled. The attacker then sends a crafted HTTP request to the vulnerable plugin endpoint. Because the handler does not validate the caller's role or capability, the request executes with the plugin's intended privileged logic. For technical specifics, see the Patchstack WordPress Vulnerability Advisory.
No verified proof-of-concept code is published. The vulnerability mechanism is described in prose only.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-108475
Indicators of Compromise
- Unexpected modifications to Broadcast Live Video plugin settings or stream configurations performed by non-administrator accounts.
- WordPress audit log entries showing admin-ajax.php or plugin REST route requests from subscriber or contributor accounts.
- New or altered live-streaming channels, keys, or broadcaster assignments without a corresponding admin action.
Detection Strategies
- Enable a WordPress activity log plugin and alert on plugin-setting changes initiated by non-administrator roles.
- Inspect web server access logs for POST requests to VideoWhisper plugin endpoints originating from low-privileged session cookies.
- Correlate authentication events with plugin configuration changes to identify privilege-boundary violations.
Monitoring Recommendations
- Monitor the installed version of videowhisper-live-streaming-integration across all WordPress sites and alert when the version is 7.3.6 or earlier.
- Baseline normal roles that interact with VideoWhisper handlers and flag deviations.
- Review new user registrations for anomalous spikes that could indicate preparation for exploitation.
How to Mitigate CVE-2026-108475
Immediate Actions Required
- Update the Broadcast Live Video plugin to a version released after 7.3.6 as soon as the vendor publishes a patched release.
- Audit all WordPress user accounts and remove unused or untrusted low-privilege accounts.
- Disable open user registration (Settings → General → Membership) if it is not required for site operation.
Patch Information
At the time of publication, the Patchstack advisory lists versions up to 7.3.6 as affected. Site operators should monitor the Patchstack advisory and the plugin's WordPress.org changelog for a fixed release and apply it immediately.
Workarounds
- Deactivate and remove the Broadcast Live Video plugin until a fixed version is available if live streaming is not business-critical.
- Deploy a WordPress-aware web application firewall rule to block requests to vulnerable plugin endpoints from non-administrator sessions.
- Restrict access to /wp-admin/admin-ajax.php and plugin REST routes using IP allow-listing for trusted broadcaster accounts where feasible.
# Example: temporarily disable the plugin via WP-CLI until a patch is released
wp plugin deactivate videowhisper-live-streaming-integration
wp plugin status videowhisper-live-streaming-integration
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
