{"id":"CVE-2026-111839","kind":"vulnerability","aliases":["CVE-2026-111839"],"related":[],"title":"WordPress Broadcast Live Video plugin: missing authorization check through 7.3.7","description":"Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.7.","summary":"The VideoWhisper Broadcast Live Video WordPress plugin (videowhisper-live-streaming-integration) has a missing authorization check in versions through 7.3.7. The sources do not say what an attacker can reach through it.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get videowhisper-live-streaming-integration --field=version`\n- Compare the result against the version range through 7.3.7","fix":"- Update the Broadcast Live Video plugin (videowhisper-live-streaming-integration) to a version newer than `7.3.7`\n- unknown: the sources do not name the first fixed version","status":"open","published_at":"2026-10-19T13:16:56+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:25:13+00:00","updated_at":"2026-10-25T04:25:13+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:25:13Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Broadcast Live Video plugin (videowhisper-live-streaming-integration) to a version newer than `7.3.7`\n- unknown: the sources do not name the first fixed version","reach":"internet","title":"WordPress Broadcast Live Video plugin: missing authorization check through 7.3.7","impact":"medium","summary":"The VideoWhisper Broadcast Live Video WordPress plugin (videowhisper-live-streaming-integration) has a missing authorization check in versions through 7.3.7. The sources do not say what an attacker can reach through it.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; missing authorization may expose protected plugin actions","analyst_note":"Find the affected function and the first fixed version from the NVD entry or the plugin's changelog (https://nvd.nist.gov/vuln/detail/CVE-2026-111839).","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get videowhisper-live-streaming-integration --field=version`\n- Compare the result against the version range through 7.3.7","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the videowhisper-live-streaming-integration WordPress plugin at version 7.3.7 or earlier are affected. Sites without this plugin installed are not. The sources do not say which configuration or role is needed to reach the flawed function.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000628,"input_tokens":3324,"output_tokens":591,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111839':13A,16A '-2026':12A,15A '7.3.7':10A,45B,85C 'access':73C 'affect':78C 'allow':69C 'attack':53B 'author':7A,40B,57C 'broadcast':2A,27B,61C,79C 'check':8A,41B 'configur':72C 'control':74C 'cve':11A,14A 'exploit':70C 'host':20B 'incorrect':71C 'integr':36B,68C 'issu':77C 'levels.this':76C 'live':3A,28B,34B,62C,66C,80C 'miss':6A,39B,56C 'n/a':83C 'packag':17B 'plugin':5A,24B,31B 'reach':55B 'say':50B 'secur':75C 'self':19B 'self-host':18B 'sourc':47B 'stream':35B,67C 'version':43B 'video':4A,29B,63C,81C 'videowhisp':26B,33B,65C 'videowhisper-live-streaming-integr':32B,64C 'videowhisper.com':60C 'vulner':58C 'wordpress':1A,21B,23B,30B 'wordpress-plugin':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the videowhisper-live-streaming-integration WordPress plugin at version 7.3.7 or earlier are affected. Sites without this plugin installed are not. The sources do not say which configuration or role is needed to reach the flawed function.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T13:16:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111839","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111839","severity":null,"published_at":"2026-10-19T13:16:56+00:00","modified_at":"2026-10-19T19:17:23+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}