CVE-2026-57716 in Broadcast Live Video Plugin
Summary
by MITRE • 07/23/2026
Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability exists in the Broadcast Live Video plugin for WordPress, affecting versions up to and including 7.2.4. The flaw represents a critical security weakness that allows unauthenticated attackers to delete arbitrary files from the target system without requiring any credentials or authentication. The vulnerability stems from insufficient input validation and access control mechanisms within the plugin's file management functionality, specifically in how it handles file deletion requests. Attackers can exploit this by crafting malicious HTTP requests that target the plugin's file deletion endpoints, potentially leading to remote code execution, complete system compromise, or data destruction.
The technical implementation of this vulnerability falls under CWE-22, which describes improper limitation of a pathname to a restricted directory, commonly known as path traversal attacks. The plugin fails to properly validate user-supplied input parameters that specify which files should be deleted, allowing attackers to manipulate these parameters to target system files outside the intended directory scope. This weakness enables attackers to navigate through the file system and delete critical components such as configuration files, core application files, or even database files that could render the entire website inaccessible or compromise its security posture.
From an operational impact perspective, this vulnerability presents a severe threat to WordPress installations using the affected plugin. Attackers can leverage this flaw to completely destroy website functionality by deleting essential files, potentially leading to complete service disruption and data loss. The unauthenticated nature of the exploit means that any visitor to the website could potentially trigger file deletion attacks, making the vulnerability particularly dangerous as it requires no prior access or credentials. This type of vulnerability also enables attackers to establish persistence mechanisms by deleting security monitoring tools or logs that might otherwise detect their activities.
The attack vector for this vulnerability aligns with ATT&CK technique T1485, which covers "Data Destruction" through the deletion of files and system components. Security professionals should note that this vulnerability can be exploited in conjunction with other attack techniques to maximize damage and maintain access. The impact extends beyond immediate file deletion as attackers may use this capability to remove security tools, backup files, or forensic evidence that could aid in incident response and recovery efforts.
Organizations should immediately update to version 7.2.5 or later of the Broadcast Live Video plugin to remediate this vulnerability. Additionally, implementing proper input validation measures, access controls, and regular security auditing can help prevent similar issues from occurring in other components of the web application stack. Network monitoring should be enhanced to detect suspicious file deletion activities, particularly when these occur outside of normal administrative procedures. Security teams must also consider implementing web application firewalls that can identify and block malicious requests attempting to exploit this type of path traversal vulnerability. Regular security assessments of third-party plugins and themes remain critical in maintaining overall system security posture, as vulnerabilities like this demonstrate the importance of keeping all components updated and properly configured.