How do I check whether I am affected by CVE-2026-111839?

- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get videowhisper-live-streaming-integration --field=version` - Compare the result against the version range through 7.3.7

What is the fix for CVE-2026-111839?

- Update the Broadcast Live Video plugin (videowhisper-live-streaming-integration) to a version newer than `7.3.7` - unknown: the sources do not name the first fixed version

Who is not affected by CVE-2026-111839?

Not affected if: plugin-not-installed.

Live › vulnerability › CVE-2026-111839

Go to dashboard

medium5.3Package

WordPress Broadcast Live Video plugin: missing authorization check through 7.3.7

The VideoWhisper Broadcast Live Video WordPress plugin (videowhisper-live-streaming-integration) has a missing authorization check in versions through 7.3.7. The sources do not say what an attacker can reach through it.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

5.3

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 19, 2026 UTC
Last modified: Oct 19, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Unknown; missing authorization may expose protected plugin actions.
CVSS said: 5.3. The facts above agree.

Who is affected

Sites running the videowhisper-live-streaming-integration WordPress plugin at version 7.3.7 or earlier are affected. Sites without this plugin installed are not. The sources do not say which configuration or role is needed to reach the flawed function.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-111839

Go to dashboard

medium5.3Package

WordPress Broadcast Live Video plugin: missing authorization check through 7.3.7

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

5.3

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 19, 2026 UTC
Last modified: Oct 19, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Unknown; missing authorization may expose protected plugin actions.
CVSS said: 5.3. The facts above agree.

Who is affected

Know the next one before it finds you.

Add to Slack

WordPress Broadcast Live Video plugin: missing authorization check through 7.3.7

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

WordPress Broadcast Live Video plugin: missing authorization check through 7.3.7

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources