CVE-2026-24937 Overview
CVE-2026-24937 is a code injection vulnerability in the VideoWhisper.Com Broadcast Live Video plugin for WordPress. The flaw affects all versions prior to 7.1.3 and allows an authenticated attacker with high privileges to inject and execute arbitrary code on the host server. The issue is categorized under [CWE-94] (Improper Control of Generation of Code).
Successful exploitation results in remote code execution, granting attackers full control over the affected WordPress instance. The vulnerability is network-exploitable with low attack complexity, requiring no user interaction.
Critical Impact
Authenticated attackers can achieve remote code execution on WordPress sites running vulnerable versions of the Broadcast Live Video plugin, compromising confidentiality, integrity, and availability.
Affected Products
- VideoWhisper.Com Broadcast Live Video plugin for WordPress
- All versions prior to 7.1.3
- WordPress sites with the videowhisper-live-streaming-integration plugin installed
Discovery Timeline
- 2026-05-25 - CVE-2026-24937 published to NVD
- 2026-05-26 - Last updated in NVD database
Technical Details for CVE-2026-24937
Vulnerability Analysis
The vulnerability resides in the VideoWhisper Broadcast Live Video plugin, a WordPress extension used for live video streaming integration. The plugin improperly controls the generation of code, allowing attacker-supplied input to be interpreted and executed as code by the PHP runtime.
The vulnerability requires high-privilege authentication (PR:H) but no user interaction. Once exploited, the attacker gains the ability to execute arbitrary PHP code in the context of the web server process. This typically results in full compromise of the WordPress installation and potentially the underlying host.
The EPSS score for this CVE is low at the time of publication, indicating limited observed exploitation activity in the wild. However, the technical impact remains severe given that successful exploitation leads to remote code execution.
Root Cause
The root cause is improper handling of user-controlled input that flows into a code-generation or code-evaluation context within the plugin. CWE-94 describes scenarios where software constructs code segments using externally-influenced input without neutralizing special elements that could alter syntax or behavior. In PHP-based WordPress plugins, this commonly occurs through unsafe use of eval(), create_function(), dynamic include/require statements, or unsafe deserialization paths.
Attack Vector
An attacker must first authenticate to the WordPress instance with high-privilege credentials, typically administrator or equivalent. The attacker then submits crafted input through a plugin endpoint that processes attacker-controlled data into a code-generation context. The PHP interpreter executes the injected payload, returning attacker-controlled output or persisting a webshell.
The vulnerability is detailed in the Patchstack WordPress Vulnerability Advisory. Refer to the advisory for technical specifics on the affected code path.
Detection Methods for CVE-2026-24937
Indicators of Compromise
- Unexpected PHP files appearing in the wp-content/plugins/videowhisper-live-streaming-integration/ directory or WordPress uploads folder
- Outbound network connections from the web server to unfamiliar hosts following plugin requests
- Unusual wp_options or plugin configuration entries containing serialized or base64-encoded payloads
- Web server process spawning shell interpreters such as sh, bash, or cmd.exe
Detection Strategies
- Monitor WordPress audit logs for administrative actions against the VideoWhisper plugin, including configuration updates and file uploads
- Inspect web server access logs for POST requests to VideoWhisper plugin endpoints originating from known administrator accounts at unusual times
- Deploy file integrity monitoring on the plugin directory to detect unauthorized file modifications
- Hunt for PHP files containing functions such as eval, assert, system, exec, or passthru in plugin and upload directories
Monitoring Recommendations
- Enable verbose logging on the WordPress installation and forward logs to a centralized SIEM for correlation
- Alert on new administrator account creation or privilege escalation events that could precede exploitation
- Track outbound DNS and HTTP traffic from web server hosts to identify command-and-control activity following compromise
How to Mitigate CVE-2026-24937
Immediate Actions Required
- Update the VideoWhisper Broadcast Live Video plugin to version 7.1.3 or later immediately
- Audit all administrator and high-privilege WordPress accounts and rotate credentials for any account that may have been compromised
- Review the plugin directory and WordPress uploads folder for unauthorized files or webshells
- Restrict administrative access to WordPress through IP allowlisting and multi-factor authentication
Patch Information
The vendor has released version 7.1.3 of the Broadcast Live Video plugin, which addresses CVE-2026-24937. Site administrators should apply this update through the WordPress plugin manager or by manually replacing the plugin files. Refer to the Patchstack WordPress Vulnerability Advisory for additional remediation guidance.
Workarounds
- Deactivate and remove the VideoWhisper Broadcast Live Video plugin until the patch can be applied
- Place the WordPress administrative interface behind a web application firewall with virtual patching capabilities
- Limit the number of accounts with administrator-level privileges and enforce least-privilege role assignments
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
