CVE-2025-8899

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8899", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-12T18:10:56.467Z", "datePublished": "2026-03-07T05:46:45.508Z", "dateUpdated": "2026-04-08T17:33:43.206Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:33:43.206Z"}, "affected": [{"vendor": "videowhisper", "product": "Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "7.3.20", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.3.20. This is due to videowhisper_register_form() function not restricting user roles that can be set during registration. This makes it possible for authenticated attackers, with Author-level access and above, to create posts/pages with the registration form and administrator set as the role and subsequently use that form to register an administrator account. This can also be exploited by contributors, but is far less likely to be successful because an administrator would need to approve the form with the administrator role for the attack to be successful."}], "title": "Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams <= 7.3.20 - Authenticated (Author+) Privilege Escalation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f71fc65f-cdc1-4f20-b37e-849ade49ee41?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ppv-live-webcams/trunk/inc/shortcodes.php#L2464"}, {"url": "https://plugins.trac.wordpress.org/changeset/3348788/ppv-live-webcams"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-269 Improper Privilege Management", "cweId": "CWE-269", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "timeline": [{"time": "2025-08-12T18:26:11.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-06T16:42:12.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T19:07:33.906057Z", "id": "CVE-2025-8899", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T19:32:58.079Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8899", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-09T19:07:33.906057Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T19:07:35.312Z"}}], "cna": {"title": "Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams <= 7.3.20 - Authenticated (Author+) Privilege Escalation", "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "videowhisper", "product": "Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.3.20"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-12T18:26:11.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-06T16:42:12.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f71fc65f-cdc1-4f20-b37e-849ade49ee41?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ppv-live-webcams/trunk/inc/shortcodes.php#L2464"}, {"url": "https://plugins.trac.wordpress.org/changeset/3348788/ppv-live-webcams"}], "descriptions": [{"lang": "en", "value": "The Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.3.20. This is due to videowhisper_register_form() function not restricting user roles that can be set during registration. This makes it possible for authenticated attackers, with Author-level access and above, to create posts/pages with the registration form and administrator set as the role and subsequently use that form to register an administrator account. This can also be exploited by contributors, but is far less likely to be successful because an administrator would need to approve the form with the administrator role for the attack to be successful."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:33:43.206Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8899", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:33:43.206Z", "dateReserved": "2025-08-12T18:10:56.467Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-07T05:46:45.508Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams", "vendor": "videowhisper", "versions": [{"lessThanOrEqual": "7.3.20", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.3.20. This is due to videowhisper_register_form() function not restricting user roles that can be set during registration. This makes it possible for authenticated attackers, with Author-level access and above, to create posts/pages with the registration form and administrator set as the role and subsequently use that form to register an administrator account. This can also be exploited by contributors, but is far less likely to be successful because an administrator would need to approve the form with the administrator role for the attack to be successful."}, {"lang": "es", "value": "El plugin Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams para WordPress es vulnerable a la escalada de privilegios en todas las versiones hasta la 7.3.20, inclusive. Esto se debe a que la funci\u00f3n videowhisper_register_form() no restringe los roles de usuario que se pueden establecer durante el registro. Esto hace posible que atacantes autenticados, con acceso de nivel de Autor y superior, creen publicaciones/p\u00e1ginas con el formulario de registro y el administrador establecido como rol, y posteriormente utilicen ese formulario para registrar una cuenta de administrador. Esto tambi\u00e9n puede ser explotado por colaboradores, pero es mucho menos probable que tenga \u00e9xito porque un administrador necesitar\u00eda aprobar el formulario con el rol de administrador para que el ataque sea exitoso."}], "id": "CVE-2025-8899", "lastModified": "2026-06-17T10:07:52.767", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8899", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T19:07:33.906057Z", "version": "2.0.3"}}]}, "published": "2026-03-07T06:16:09.350", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ppv-live-webcams/trunk/inc/shortcodes.php#L2464"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3348788/ppv-live-webcams"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f71fc65f-cdc1-4f20-b37e-849ade49ee41?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.3.20]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams", "source": "cna", "vendor": "videowhisper"}, "product": "paid_videochat_turnkey_site_\u2013_html5_ppv_live_webcams", "vendor": "videowhisper"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-20T18:46:33.653627+00:00", "value": {"mitigation_remediation": ["Upgrade the Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams plugin to the latest version that removes the unchecked role assignment bug", "If an upgrade is not yet available, disable or remove the ability in the plugin to set the registration role to Administrator, ensuring only non\u2011privileged roles can be chosen", "Monitor for any new administrator accounts or suspicious role changes in WordPress, and revoke any accounts created without proper approval"], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation to create administrator accounts"}, "threat_synthesis": {"affected_systems": "Any WordPress site running the Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams plugin version 7.3.20 or earlier is susceptible. Sites should verify the plugin version and update to a newer release if available. The vendor, videowhisper, offers the plugin under the name Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams.", "description_and_impact": "The Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams plugin for WordPress has a flaw that allows an authenticated user with Author or higher privileges to set a registration form\u2019s target role to administrator. By creating such a form and then registering through it, the attacker can spawn an account with administrative rights. The vulnerability stems from unchecked role assignment in the videowhisper_register_form() function, representing an improper privilege management weakness (CWE\u2011269).", "risk_and_exploitability": "The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not currently listed in CISA's KEV catalog. Exploitation requires an account with Author or higher privileges, and the attacker must successfully configure a form that assigns the administrator role before using it to register. Once the form is deployed, the attacker can create an administrator account without further privileges. The attack vector is likely remote via the WordPress back\u2011end, and the attacker must have prior authenticated access to create forms."}}}}, "created": "2026-03-09T10:05:47.708466+00:00", "updated": "2026-04-20T19:00:10.661569+00:00", "vendors": ["videowhisper", "videowhisper$PRODUCT$paid_videochat_turnkey_site_\u2013_html5_ppv_live_webcams", "wordpress", "wordpress$PRODUCT$wordpress"]}