CVE-2026-57331: Paid Videochat Path Traversal Flaw

CVE-2026-57331 Overview

CVE-2026-57331 is a path traversal vulnerability in the Paid Videochat Turnkey Site WordPress plugin (also known as ppv-live-webcams) affecting versions up to and including 7.4.8. The flaw allows an authenticated user with performer-level privileges to delete arbitrary files on the underlying server. Successful exploitation can remove critical WordPress files such as wp-config.php, forcing the site into installation mode and enabling site takeover. The issue is tracked as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
An authenticated performer account can delete arbitrary files on the WordPress host, leading to full site compromise and loss of availability.

Affected Products

WordPress plugin: Paid Videochat Turnkey Site (ppv-live-webcams)
All versions up to and including 7.4.8
WordPress sites running the vulnerable plugin with performer accounts enabled

Discovery Timeline

2026-06-29 - CVE-2026-57331 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-57331

Vulnerability Analysis

The Paid Videochat Turnkey Site plugin exposes a file deletion routine accessible to users holding the performer role. The routine accepts a user-controlled file path and passes it to a filesystem delete operation without validating that the target resides within an allowed directory. An attacker supplies a path containing directory traversal sequences such as ../ to escape the intended location and reference files elsewhere on the server.

Because the operation runs with the privileges of the PHP process, any file the web server can write to is a candidate for deletion. Attackers commonly target wp-config.php to trigger the WordPress installer flow, then re-run installation to hijack the site by connecting it to an attacker-controlled database. The scope-changed CVSS vector reflects that impact extends beyond the plugin to the entire WordPress instance and adjacent components.

Root Cause

The root cause is missing path canonicalization and allowlist validation before invoking file deletion. The plugin trusts user-supplied input identifying the file to remove and does not confirm the resolved absolute path stays within the plugin's own upload or media directories.

Attack Vector

Exploitation requires an authenticated session with performer privileges, which the plugin allows users to obtain through its registration workflow. The attacker sends a crafted HTTP request to the vulnerable endpoint containing a traversal payload in the filename parameter. No user interaction is required and the request travels over the network. See the Patchstack WordPress Vulnerability Report for additional technical detail.

// No verified proof-of-concept code is publicly available.
// The vulnerability class involves passing an unsanitized filename
// parameter containing '../' sequences to a PHP unlink() call,
// resolving outside the plugin's intended directory.

Detection Methods for CVE-2026-57331

Indicators of Compromise

Unexpected deletion of core WordPress files such as wp-config.php, .htaccess, or theme and plugin files.
WordPress unexpectedly presenting the installation setup page to visitors, indicating loss of wp-config.php.
HTTP requests to ppv-live-webcams plugin endpoints containing ../ or URL-encoded %2e%2e%2f sequences in filename parameters.
New or recently active performer-role accounts issuing file management requests.

Detection Strategies

Inspect web server access logs for POST requests to plugin routes referencing filename parameters with traversal patterns.
Alert on filesystem delete events targeting files outside the plugin's expected upload directory, especially WordPress core files.
Correlate performer-role authentication events with subsequent file deletion activity on the host.

Monitoring Recommendations

Enable WordPress audit logging for user registration, role changes, and plugin-invoked file operations.
Forward web server, PHP-FPM, and file integrity monitoring logs to a central analytics platform for correlation.
Baseline the plugin's normal file deletion behavior and alert on deviations targeting paths outside its media directories.

How to Mitigate CVE-2026-57331

Immediate Actions Required

Identify all WordPress installations running the ppv-live-webcams plugin at version 7.4.8 or earlier.
Disable the plugin on affected sites until a patched release is confirmed installed.
Audit performer-role accounts and disable registration if performer accounts are not actively required.
Restore wp-config.php and any deleted files from backup if tampering is suspected, and rotate database credentials and secret keys.

Patch Information

At the time of publication, refer to the Patchstack WordPress Vulnerability Report for the latest fixed version and remediation guidance. Update the plugin to a release higher than 7.4.8 once available from the vendor.

Workarounds

Restrict access to WordPress administrative and plugin AJAX endpoints using a web application firewall rule that blocks ../ and %2e%2e in request parameters.
Enforce filesystem permissions so the PHP process cannot delete or overwrite wp-config.php and other core files.
Temporarily remove the performer role registration option until the plugin is updated.

bash

# Example: use WP-CLI to deactivate the vulnerable plugin
wp plugin deactivate ppv-live-webcams --all

# Example: harden wp-config.php against deletion by the web user
chown root:www-data /var/www/html/wp-config.php
chmod 640 /var/www/html/wp-config.php