CVE-2026-24590

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24590", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-23T12:32:12.342Z", "datePublished": "2026-05-26T08:24:28.017Z", "dateUpdated": "2026-05-26T10:47:02.945Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-05-26T08:24:28.017Z"}, "title": "WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Broken Access Control vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "VideoWhisper.com", "product": "Paid Videochat Turnkey Site", "collectionURL": "https://wordpress.org/plugins", "packageName": "ppv-live-webcams", "versions": [{"status": "affected", "version": "n/a", "lessThanOrEqual": "7.3.23", "changes": [{"at": "7.3.24", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in VideoWhisper.Com Paid Videochat Turnkey Site allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects Paid Videochat Turnkey Site: from n/a through 7.3.23.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Missing Authorization vulnerability in VideoWhisper.Com Paid Videochat Turnkey Site allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Paid Videochat Turnkey Site: from n/a through 7.3.23.</p>"}]}], "tags": ["x_open-source"], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-plugin-7-3-23-broken-access-control-vulnerability-2?_s_id=cve", "tags": ["vdb-entry"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "solutions": [{"lang": "en", "value": "Update the WordPress Paid Videochat Turnkey Site Plugin to the latest available version (at least 7.3.24).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Update the WordPress Paid Videochat Turnkey Site Plugin to the latest available version (at least 7.3.24)."}]}], "credits": [{"lang": "en", "value": "ChuongVN | Patchstack Bug Bounty Program", "user": "00000000-0000-4000-9000-000000000000", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-26T10:42:23.277397Z", "id": "CVE-2026-24590", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T10:47:02.945Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24590", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T10:42:23.277397Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T10:46:57.457Z"}}], "cna": {"tags": ["x_open-source"], "title": "WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Broken Access Control vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "ChuongVN | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "VideoWhisper.com", "product": "Paid Videochat Turnkey Site", "versions": [{"status": "affected", "changes": [{"at": "7.3.24", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "7.3.23"}], "packageName": "ppv-live-webcams", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update the WordPress Paid Videochat Turnkey Site Plugin to the latest available version (at least 7.3.24).", "supportingMedia": [{"type": "text/html", "value": "Update the WordPress Paid Videochat Turnkey Site Plugin to the latest available version (at least 7.3.24).", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-plugin-7-3-23-broken-access-control-vulnerability-2?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in VideoWhisper.Com Paid Videochat Turnkey Site allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects Paid Videochat Turnkey Site: from n/a through 7.3.23.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in VideoWhisper.Com Paid Videochat Turnkey Site allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Paid Videochat Turnkey Site: from n/a through 7.3.23.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-05-26T08:24:28.017Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24590", "state": "PUBLISHED", "dateUpdated": "2026-05-26T10:47:02.945Z", "dateReserved": "2026-01-23T12:32:12.342Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-05-26T08:24:28.017Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "ppv-live-webcams", "product": "Paid Videochat Turnkey Site", "vendor": "VideoWhisper.com", "versions": [{"changes": [{"at": "7.3.24", "status": "unaffected"}], "lessThanOrEqual": "7.3.23", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in VideoWhisper.Com Paid Videochat Turnkey Site allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects Paid Videochat Turnkey Site: from n/a through 7.3.23."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en el sitio llave en mano de videochat de pago de VideoWhisper.Com permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente.\n\nEste problema afecta al sitio llave en mano de videochat de pago: desde n/a hasta 7.3.23."}], "id": "CVE-2026-24590", "lastModified": "2026-07-24T11:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24590", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-26T10:42:23.277397Z", "version": "2.0.3"}}]}, "published": "2026-05-26T09:16:19.130", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-plugin-7-3-23-broken-access-control-vulnerability-2?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.3.23]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Paid Videochat Turnkey Site", "source": "cna", "vendor": "VideoWhisper.com"}, "product": "paid_videochat_turnkey_site", "vendor": "videowhisper.com"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "created": "2026-05-26T10:30:03.167885+00:00", "updated": "2026-05-26T12:59:34.240568+00:00", "vendors": ["videowhisper.com", "videowhisper.com$PRODUCT$paid_videochat_turnkey_site", "wordpress", "wordpress$PRODUCT$wordpress"]}