{"id":"CVE-2026-115963","kind":"vulnerability","aliases":["CVE-2026-115963"],"related":[],"title":"WordPress Broadcast Live Video plugin: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.9.","summary":"The Broadcast Live Video WordPress plugin (videowhisper-live-streaming-integration) through version 7.3.9 lacks an authorization check, so access controls are not enforced as intended. The sources do not state exactly what an attacker can read or change.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["live-streaming","package","videowhisper","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the videowhisper-live-streaming-integration plugin in the WordPress admin plugin list; the sources say versions through `7.3.9` are affected.","fix":"- Broadcast Live Video plugin: unknown; the sources do not name a fixed version.","status":"open","published_at":"2026-10-29T11:17:31+00:00","first_seen_at":"2026-10-29T11:24:28+00:00","triaged_at":"2026-10-29T11:25:33+00:00","updated_at":"2026-10-29T11:25:33+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T11:25:33Z","model":"claude-haiku-5-5","output":{"fix":"- Broadcast Live Video plugin: unknown; the sources do not name a fixed version.","reach":"internet","title":"WordPress Broadcast Live Video plugin: missing authorization check exposes access controls","impact":"medium","summary":"The Broadcast Live Video WordPress plugin (videowhisper-live-streaming-integration) through version 7.3.9 lacks an authorization check, so access controls are not enforced as intended. The sources do not state exactly what an attacker can read or change.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","videowhisper","live-streaming"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access-control bypass on affected WordPress sites","analyst_note":"Find the NVD entry details and the vendor's changelog to confirm which endpoints are affected and the fixed version past 7.3.9.","how_to_check":"- Check the installed version of the videowhisper-live-streaming-integration plugin in the WordPress admin plugin list; the sources say versions through `7.3.9` are affected.\n- unknown for further checks; the sources do not say which endpoints or settings are involved.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Broadcast Live Video WordPress plugin (videowhisper-live-streaming-integration) at version 7.3.9 or earlier. The sources do not say which features or roles are exposed, so unknown whether a logged-out visitor can reach the flaw.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00071,"input_tokens":4131,"output_tokens":593,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115963':14A,17A '-2026':13A,16A '7.3.9':37B,92C 'access':10A,43B,80C 'affect':85C 'allow':76C 'attack':58B 'author':7A,40B,64C 'broadcast':2A,25B,68C,86C 'chang':62B 'check':8A,41B 'configur':79C 'control':11A,44B,81C 'cve':12A,15A 'enforc':47B 'exact':55B 'exploit':77C 'expos':9A 'incorrect':78C 'integr':34B,75C 'intend':49B 'issu':84C 'lack':38B 'levels.this':83C 'live':3A,19B,26B,32B,69C,73C,87C 'live-stream':18B 'miss':6A,63C 'n/a':90C 'packag':21B 'plugin':5A,29B 'read':60B 'secur':82C 'sourc':51B 'state':54B 'stream':20B,33B,74C 'version':36B 'video':4A,27B,70C,88C 'videowhisp':22B,31B,72C 'videowhisper-live-streaming-integr':30B,71C 'videowhisper.com':67C 'vulner':65C 'wordpress':1A,23B,28B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Broadcast Live Video WordPress plugin (videowhisper-live-streaming-integration) at version 7.3.9 or earlier. The sources do not say which features or roles are exposed, so unknown whether a logged-out visitor can reach the flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T11:17:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115963","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115963","severity":null,"published_at":"2026-10-29T11:17:31+00:00","modified_at":"2026-10-29T11:17:31+00:00","first_seen_at":"2026-10-29T11:24:28+00:00","fetched_at":"2026-10-29T11:24:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}