CVE-2026-108476: Paid Videochat Auth Bypass Vulnerability

CVE-2026-108476 Overview

CVE-2026-108476 is a missing authorization vulnerability in the VideoWhisper.com Paid Videochat Turnkey Site (ppv-live-webcams) WordPress plugin. The flaw affects all versions up to and including 7.5.13. The vulnerability stems from incorrectly configured access control security levels, allowing authenticated users with low privileges to access functionality they should not reach. The weakness is classified as [CWE-862] Missing Authorization.

Critical Impact
Authenticated attackers with low-privilege accounts can exploit broken access control to interact with plugin functionality across trust boundaries, leading to unauthorized information exposure within the WordPress site.

Affected Products

VideoWhisper.com Paid Videochat Turnkey Site (ppv-live-webcams WordPress plugin)
All versions from n/a through 7.5.13
WordPress installations running the affected plugin

Discovery Timeline

2026-10-12 - CVE-2026-108476 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-108476

Vulnerability Analysis

The plugin exposes functionality without verifying whether the requesting user holds the required capability or role. An authenticated user can invoke plugin endpoints that should be restricted to higher-privilege contexts. Because the scope changes during exploitation, actions impact resources beyond the attacker's authorized boundary.

The impact is limited to confidentiality. The vulnerability does not permit modification of data or disruption of service, but it enables an attacker to retrieve information intended for other users or administrators.

Root Cause

The root cause is missing authorization checks on plugin actions ([CWE-862]). The affected code paths rely on authentication alone and do not call WordPress capability checks such as current_user_can() or verify ownership of the targeted resource before executing privileged operations.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated session with low privileges, such as a subscriber-level account. No user interaction is required beyond sending the crafted request. The attacker issues HTTP requests to the vulnerable plugin endpoints to trigger operations that bypass the intended access control model. Refer to the Patchstack WordPress Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2026-108476

Indicators of Compromise

Unexpected HTTP requests from low-privileged user sessions targeting ppv-live-webcams plugin endpoints under /wp-content/plugins/ppv-live-webcams/ or admin-ajax.php actions registered by the plugin
WordPress audit log entries showing subscriber-level accounts accessing content or settings owned by other users
Access patterns where a single authenticated account enumerates multiple resource identifiers in short succession

Detection Strategies

Review WordPress access logs for authenticated requests to plugin endpoints that do not match the user's role or expected workflow
Correlate admin-ajax.php and REST API calls from low-privilege accounts with the plugin action parameter to identify abuse
Deploy a web application firewall rule to flag requests to ppv-live-webcams actions originating from subscriber accounts

Monitoring Recommendations

Enable verbose WordPress logging via a security plugin to capture user ID, requested action, and HTTP response for all plugin interactions
Alert on spikes in 200-status responses to plugin AJAX endpoints from non-administrator sessions
Monitor for the creation of new low-privilege accounts followed by immediate access to plugin functionality

How to Mitigate CVE-2026-108476

Immediate Actions Required

Identify all WordPress sites running the ppv-live-webcams plugin version 7.5.13 or earlier
Restrict user registration or temporarily disable low-privilege account creation on affected sites until a patched version is applied
Review existing subscriber-level accounts for signs of unauthorized access to plugin resources

Patch Information

As of the NVD publication date, no fixed version is explicitly listed in the public advisory. Monitor the Patchstack advisory and the plugin's WordPress.org changelog for a release beyond 7.5.13 that addresses the missing authorization checks. Apply the update immediately once available.

Workarounds

Deactivate the ppv-live-webcams plugin until a vendor patch is released if the functionality is not business-critical
Deploy a virtual patch through a WordPress-aware WAF to block unauthenticated and low-privilege requests to the plugin's AJAX and REST endpoints
Enforce the principle of least privilege by auditing user roles and removing unnecessary accounts with access to the WordPress site

bash

# Example: temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate ppv-live-webcams

# Example: list all users with subscriber role for review
wp user list --role=subscriber --fields=ID,user_login,user_registered