{"id":"CVE-2026-110883","kind":"vulnerability","aliases":["CVE-2026-110883"],"related":[],"title":"VideoWhisper 2Way VideoCalls and Random Chat: authentication bypass through version 6.1.5","description":"Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.5.","summary":"The VideoWhisper 2Way VideoCalls and Random Chat WordPress plugin (webcam-2way-videochat) has an authentication bypass caused by a primary weakness, per the NVD description. Affected versions run from n/a through 6.1.5, and the sources do not say exactly what an attacker gains.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","webcam-2way-videochat","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the webcam-2way-videochat plugin in the WordPress admin plugin list, or with `wp plugin get webcam-2way-videochat --field=version`\n- Compare it against the affected range through `6.1.5`","fix":"- Update the webcam-2way-videochat plugin to a version later than `6.1.5`; the sources do not name the fixed version\n- If no fixed release exists, deactivate the plugin until a vendor fix is published","status":"open","published_at":"2026-10-18T11:16:37+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:57:33+00:00","updated_at":"2026-10-25T03:57:33+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T03:57:33Z","model":"claude-haiku-5-5","output":{"fix":"- Update the webcam-2way-videochat plugin to a version later than `6.1.5`; the sources do not name the fixed version\n- If no fixed release exists, deactivate the plugin until a vendor fix is published","reach":"unknown","title":"VideoWhisper 2Way VideoCalls and Random Chat: authentication bypass through version 6.1.5","impact":"medium","summary":"The VideoWhisper 2Way VideoCalls and Random Chat WordPress plugin (webcam-2way-videochat) has an authentication bypass caused by a primary weakness, per the NVD description. Affected versions run from n/a through 6.1.5, and the sources do not say exactly what an attacker gains.","category":"package","nicknames":[],"who_cares":["wordpress","webcam-2way-videochat"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources only say authentication can be bypassed","analyst_note":"Find the vendor advisory or Wordfence/NVD detail naming the fixed version, the vulnerable endpoint, and what access the bypass grants.","how_to_check":"- Check the installed version of the webcam-2way-videochat plugin in the WordPress admin plugin list, or with `wp plugin get webcam-2way-videochat --field=version`\n- Compare it against the affected range through `6.1.5`","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the VideoWhisper 2Way VideoCalls and Random Chat plugin at version 6.1.5 or lower are in scope. The sources do not describe the configuration or feature path that makes the bypass reachable, so unknown whether all installs are exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000651,"input_tokens":3330,"output_tokens":635,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110883':14A,17A '-2026':13A,16A '2way':2A,21B,26B,35B,76C,83C,90C '6.1.5':11A,56B,98C 'abuse.this':87C 'affect':50B,89C 'allow':85C 'attack':66B 'authent':7A,39B,68C,86C 'bypass':8A,40B,69C 'caus':41B 'chat':6A,30B,80C,94C 'cve':12A,15A 'descript':49B 'exact':63B 'gain':67B 'issu':88C 'n/a':54B,96C 'nvd':48B 'packag':18B 'per':46B 'plugin':32B 'primari':44B,71C 'random':5A,29B,79C,93C 'run':52B 'say':62B 'sourc':59B 'version':10A,51B 'videocal':3A,27B,77C,91C 'videochat':22B,36B,84C 'videowhisp':1A,25B 'videowhisper.com':75C 'vulner':73C 'weak':45B,72C 'webcam':20B,34B,82C 'webcam-2way-videochat':19B,33B,81C 'wordpress':23B,31B","nicknames":[],"mitigations":[],"who_affected":"Sites running the VideoWhisper 2Way VideoCalls and Random Chat plugin at version 6.1.5 or lower are in scope. The sources do not describe the configuration or feature path that makes the bypass reachable, so unknown whether all installs are exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T11:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110883","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110883","severity":null,"published_at":"2026-10-18T11:16:37+00:00","modified_at":"2026-10-19T19:17:22+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}