CVE-2026-27053: Broadcast Live Video Auth Bypass Flaw

CVE-2026-27053 Overview

CVE-2026-27053 is an unauthenticated PHP Object Injection vulnerability in the Broadcast Live Video WordPress plugin (also known as VideoWhisper Live Streaming Integration) in versions prior to 7.1.3. The flaw allows remote attackers to inject arbitrary PHP objects without authentication. Exploitation can lead to remote code execution, file manipulation, or full site compromise when a suitable gadget chain is present. The vulnerability is classified under CWE-502: Deserialization of Untrusted Data.

Critical Impact
Unauthenticated attackers can trigger PHP object deserialization remotely over the network, enabling arbitrary code execution and full takeover of affected WordPress installations.

Affected Products

Broadcast Live Video (VideoWhisper Live Streaming Integration) WordPress plugin
All versions prior to 7.1.3
WordPress sites running the vulnerable plugin in any configuration

Discovery Timeline

2026-06-15 - CVE-2026-27053 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-27053

Vulnerability Analysis

The vulnerability resides in the Broadcast Live Video plugin's handling of serialized PHP data supplied through user-controlled input. The plugin passes untrusted input to unserialize() without validation or use of safe alternatives such as json_decode(). This allows an attacker to craft a serialized payload that instantiates arbitrary PHP objects when processed by the plugin.

PHP Object Injection becomes exploitable when the application or any loaded library defines magic methods such as __wakeup(), __destruct(), or __toString() that perform sensitive operations. WordPress core and common plugins ship gadget chains that can be leveraged to achieve file writes, SQL execution, or remote code execution. The unauthenticated nature of the attack removes any barrier to entry.

Root Cause

The root cause is unsafe deserialization of attacker-controlled data. Input received over HTTP is passed to PHP's native unserialize() function, which automatically reconstructs objects and invokes their magic methods. The plugin does not sanitize, validate, or restrict the classes accepted during deserialization.

Attack Vector

An attacker delivers a crafted serialized payload to a vulnerable plugin endpoint over the network. No credentials or user interaction are required. When the plugin processes the request, PHP reconstructs the malicious object graph and triggers gadget chain execution, leading to code execution or other unauthorized actions within the WordPress process.

For technical specifics, see the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-27053

Indicators of Compromise

HTTP requests to Broadcast Live Video plugin endpoints containing serialized PHP markers such as O:, a:, or s: followed by class names.
Unexpected PHP files written to the WordPress wp-content/uploads/ directory or plugin directories.
New or modified administrator accounts in the WordPress wp_users table without corresponding admin activity.
Outbound network connections from the web server to unfamiliar hosts following requests to plugin URLs.

Detection Strategies

Inspect web server access logs for POST or GET parameters containing unserialize-style payloads targeting /wp-content/plugins/videowhisper-live-streaming-integration/.
Deploy web application firewall rules that flag serialized PHP object signatures in request bodies and query strings.
Monitor PHP error logs for __wakeup, __destruct, or class instantiation errors originating from the plugin.

Monitoring Recommendations

Enable file integrity monitoring across the WordPress installation and alert on changes to PHP files outside scheduled updates.
Capture and review process telemetry for the web server user spawning shells, curl, wget, or php child processes.
Forward web server, PHP, and WordPress audit logs to a centralized SIEM for correlation across hosts.

How to Mitigate CVE-2026-27053

Immediate Actions Required

Upgrade the Broadcast Live Video plugin to version 7.1.3 or later on all WordPress sites.
Audit affected sites for indicators of compromise, including unauthorized admin users, modified plugin files, and unexpected scheduled tasks.
Rotate WordPress administrator passwords, secret keys in wp-config.php, and any API tokens stored on the server if compromise is suspected.

Patch Information

The vendor addressed the vulnerability in Broadcast Live Video version 7.1.3. Site administrators should update through the WordPress plugin manager or by replacing the plugin files manually. Refer to the Patchstack Vulnerability Report for advisory details.

Workarounds

Deactivate and remove the Broadcast Live Video plugin until the patched version can be deployed.
Restrict access to plugin endpoints via web server rules or a web application firewall while patching is scheduled.
Apply virtual patching rules that block serialized PHP payloads in HTTP requests to the plugin path.

bash

# Configuration example: block serialized PHP payloads targeting the plugin
# Example ModSecurity rule
SecRule REQUEST_URI "@contains /wp-content/plugins/videowhisper-live-streaming-integration/" \
    "chain,id:1027053,phase:2,deny,status:403,msg:'CVE-2026-27053 PHP Object Injection attempt'"
    SecRule ARGS|REQUEST_BODY "@rx (?:^|[^a-zA-Z0-9])O:\d+:\"[A-Za-z_][A-Za-z0-9_\\\\]*\":\d+:\{" \
        "t:none,t:urlDecodeUni"