CVE-2026-24590: Paid Videochat Auth Bypass Vulnerability

CVE-2026-24590 Overview

CVE-2026-24590 is a Missing Authorization vulnerability [CWE-862] in the VideoWhisper.Com Paid Videochat Turnkey Site WordPress plugin (ppv-live-webcams). The flaw stems from incorrectly configured access control security levels in the plugin. Unauthenticated attackers can reach functionality that should be restricted to authorized users. The issue affects all versions from n/a through 7.3.23. The vulnerability is exploitable over the network without privileges or user interaction and impacts confidentiality of plugin data.

Critical Impact
Unauthenticated network attackers can bypass access control checks in the Paid Videochat Turnkey Site plugin and access restricted plugin functionality, leading to information exposure.

Affected Products

VideoWhisper.Com Paid Videochat Turnkey Site WordPress plugin (ppv-live-webcams)
All versions from n/a through 7.3.23
WordPress sites that have the plugin installed and active

Discovery Timeline

2026-05-26 - CVE-2026-24590 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-24590

Vulnerability Analysis

The vulnerability is a Broken Access Control flaw in the Paid Videochat Turnkey Site plugin for WordPress. The plugin exposes one or more actions that fail to enforce the expected authorization checks. As a result, requests that should require a specific role or capability are processed regardless of the requester's identity. The CWE classification (CWE-862 Missing Authorization) confirms that an authorization check is absent rather than incorrectly evaluated. According to the Patchstack advisory, the impact is limited to confidentiality, meaning attackers can read or trigger functions that disclose information they should not see.

Root Cause

The plugin's action handlers do not validate the caller's permissions before executing. In WordPress plugins, authorization is typically enforced through current_user_can() capability checks, role validation, or nonce verification combined with capability checks. The affected handlers in ppv-live-webcams omit these checks on at least one endpoint, allowing unauthenticated callers to reach logic intended for privileged contexts.

Attack Vector

An attacker sends a crafted HTTP request to the vulnerable plugin endpoint on a WordPress site running a version up to and including 7.3.23. No authentication, no privileges, and no user interaction are required. The request invokes plugin functionality that should be access-controlled and returns data or triggers behavior the attacker should not be able to access. See the Patchstack Vulnerability Report for advisory details.

// No verified public exploit code is available for CVE-2026-24590.
// Refer to the Patchstack advisory for technical specifics.

Detection Methods for CVE-2026-24590

Indicators of Compromise

Unauthenticated HTTP requests targeting admin-ajax.php or REST routes registered by the ppv-live-webcams plugin.
Anomalous access patterns to plugin endpoints from IP addresses that have not authenticated to WordPress.
Web server logs showing repeated 200 responses to plugin actions from sessions with no wordpress_logged_in_* cookies.

Detection Strategies

Inventory WordPress sites and identify any with the Paid Videochat Turnkey Site plugin (ppv-live-webcams) at version 7.3.23 or earlier.
Add web application firewall (WAF) rules that inspect requests to the plugin's action handlers and flag those without an authenticated session.
Review access logs for spikes in requests containing the plugin's action names or REST namespace.

Monitoring Recommendations

Forward WordPress access and PHP error logs to a centralized logging or SIEM platform for correlation.
Alert on unauthenticated requests to plugin endpoints that return non-empty response bodies.
Track plugin version drift across managed WordPress instances to confirm patch deployment.

How to Mitigate CVE-2026-24590

Immediate Actions Required

Update the Paid Videochat Turnkey Site plugin to a version later than 7.3.23 once the vendor publishes a fixed release.
If no fixed version is available, disable and remove the ppv-live-webcams plugin on production sites.
Restrict access to WordPress administrative and AJAX endpoints to known IP ranges where feasible.

Patch Information

At the time of publication, the Patchstack advisory lists the vulnerability as affecting versions through 7.3.23. Administrators should monitor the WordPress plugin repository and the Patchstack database for an official patched release from VideoWhisper.Com and apply it as soon as it becomes available.

Workarounds

Deploy a WAF rule that blocks unauthenticated requests to the plugin's action endpoints until a patch is applied.
Temporarily deactivate the ppv-live-webcams plugin if the videochat functionality is non-essential.
Restrict access to the WordPress site to authenticated users via server-level controls where the business model allows.

bash

# Example: disable the plugin via WP-CLI until a fixed version is released
wp plugin deactivate ppv-live-webcams
wp plugin status ppv-live-webcams