CVE-2026-108476 in Paid Videochat Turnkey Site Plugin
Summary
by MITRE • 10/12/2026
Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.13.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The identified vulnerability represents a critical failure in access control mechanisms within the VideoWhisper.com Paid Videochat Turnkey Site, specifically affecting versions ranging from initial releases up to version 7.5.13. This flaw is classified as an Incorrectly Configured Access Control Security Level issue, which fundamentally undermines the integrity of the application's security model by allowing unauthorized entities to bypass intended restrictions on sensitive resources or functionalities. In web applications that handle paid services and user-generated content, such as video chat platforms, maintaining strict separation between public, subscriber-only, and administrative functions is paramount for both business logic enforcement and data privacy compliance.
At a technical level, this vulnerability stems from the application's inability to properly validate whether an authenticated or unauthenticated requestor possesses the necessary privileges to access specific endpoints or perform certain actions. The server-side logic fails to enforce authorization checks consistently across all entry points, particularly in areas managing live video streams, payment processing interfaces, or user profile configurations. An attacker can exploit this misconfiguration by crafting requests that target internal APIs or administrative pages without providing valid credentials for those roles. This type of flaw is commonly associated with CWE-285 Improper Authorization and often maps to the ATT&CK technique T1078 Valid Accounts if existing low-level accounts are leveraged, or T1136 Create Account if new privileged accounts can be created due to insufficient verification during registration processes.
The operational impact of this vulnerability is severe for both service providers and end-users. For administrators, it may lead to unauthorized access to backend management consoles, allowing attackers to modify site settings, view sensitive user data, or even deploy malicious scripts that compromise the entire platform infrastructure. For subscribers, the risk involves potential exposure of private video streams, personal identification information, and payment details that are supposed to be protected by subscription tiers. The exploitation could result in significant financial loss through unauthorized transactions, reputational damage due to publicized security breaches, and legal liabilities under data protection regulations such as GDPR or CCPA if personally identifiable information is exfiltrated without consent.
Mitigation strategies must focus on implementing robust server-side authorization checks for every protected resource rather than relying solely on client-side controls which can be easily bypassed. Developers should adopt a principle of least privilege, ensuring that each user role has only the permissions strictly necessary for their function. It is essential to integrate centralized access control middleware that validates session tokens and permission levels before processing any request related to paid features or administrative functions. Additionally, regular security audits and penetration testing focused on broken object level authorization patterns are recommended to identify similar gaps in other parts of the application stack. Upgrading to a patched version where these access controls have been rigorously tested and corrected is the most effective immediate remediation step for organizations still running affected versions.