high advisory October 29, 2026

VideoWhisper Broadcast Live Video: Missing Authorization Vulnerability (CVE-2026-115963)

The VideoWhisper Broadcast Live Video WordPress plugin contains a missing authorization vulnerability (CVE-2026-115963) in versions up to 7.3.9, allowing unauthorized users to bypass access control checks.

Triage facts

Revision 1

Applicability: Broadcast Live Video (<= 7.3.9)
Evidence: Unknown
Severity: High
Action: Elevated
Sources: 1 public source
Freshness: Revision 1Oct 29, 13:20 UTC
Vulnerabilities: 1 CVE
Source quality: A1Roughly even chance

A missing authorization vulnerability in the VideoWhisper Broadcast Live Video WordPress plugin, tracked as CVE-2026-115963, allows unauthorized actors to perform actions restricted by access control levels. The vulnerability affects all versions up to and including 7.3.9. There is no information provided regarding a fix or update version at this time.

Impact

Successful exploitation may allow an unauthorized user to perform administrative or restricted actions within the plugin, potentially leading to unauthorized access to features or data managed by the integration.

Recommendation

Inventory all WordPress instances running the VideoWhisper Broadcast Live Video plugin.
Disable the plugin if it is not business-critical until an official security update is released by the vendor.
Monitor WordPress administrative logs for unauthorized access to plugin settings or video stream configurations.

Immediate actions

Inventory WordPress environments for Broadcast Live Video plugin versions <= 7.3.9

IT Operations 24h

Threat Hunt

Monitor web server access logs for anomalous POST/GET requests directed at plugin-specific API endpoints or configuration pages

T1068 medium medium confidence hunt now

Data: Web server access logs

Mitigations

Disable the VideoWhisper Broadcast Live Video plugin until a patched version is released

immediate IT Operations

CVE-2026-115963