{"id":"CVE-2026-120857","kind":"vulnerability","aliases":["CVE-2026-120857"],"related":[],"title":"WordPress 2Way VideoCalls plugin: missing authorization check through 6.1.9","description":"Missing Authorization vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.9.","summary":"The 2Way VideoCalls and Random Chat WordPress webcam plugin lacks an authorization check on some functionality. Because access control is misconfigured, an attacker may reach actions they should not be allowed to perform.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","webcam-2way-videochat","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `webcam-2way-videochat` plugin is installed on your WordPress site and note its version.\n- Compare the installed version against `6.1.9`; versions through `6.1.9` are listed as affected.","fix":null,"status":"open","published_at":"2026-11-07T11:17:00+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","triaged_at":"2026-11-07T11:48:30+00:00","updated_at":"2026-11-07T11:48:30+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T11:48:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress 2Way VideoCalls plugin: missing authorization check through 6.1.9","impact":"medium","summary":"The 2Way VideoCalls and Random Chat WordPress webcam plugin lacks an authorization check on some functionality. Because access control is misconfigured, an attacker may reach actions they should not be allowed to perform.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","webcam-2way-videochat"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access-control bypass on the plugin's features","analyst_note":"Check NVD and the plugin's changelog for the fixed version and which actions lack authorization checks.","how_to_check":"- Check whether the `webcam-2way-videochat` plugin is installed on your WordPress site and note its version.\n- Compare the installed version against `6.1.9`; versions through `6.1.9` are listed as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the 2Way VideoCalls and Random Chat WordPress plugin at version 6.1.9 or earlier are in scope. The sources do not describe which actions are exposed or which roles can reach them, so sites without this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":4247,"output_tokens":520,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120857':12A,15A '-2026':11A,14A '2way':2A,19B,23B,60C,67C,79C '6.1.9':9A,87C 'access':39B,73C 'action':47B 'affect':78C 'allow':52B,69C 'attack':44B 'author':6A,33B,56C 'chat':27B,64C,83C 'check':7A,34B 'configur':72C 'control':40B,74C 'cve':10A,13A 'exploit':70C 'function':37B 'incorrect':71C 'issu':77C 'lack':31B 'levels.this':76C 'may':45B 'misconfigur':42B 'miss':5A,55C 'n/a':85C 'packag':16B 'perform':54B 'plugin':4A,30B 'random':26B,63C,82C 'reach':46B 'secur':75C 'videocal':3A,24B,61C,80C 'videochat':20B,68C 'videowhisper.com':59C 'vulner':57C 'webcam':18B,29B,66C 'webcam-2way-videochat':17B,65C 'wordpress':1A,21B,28B","nicknames":[],"mitigations":[],"who_affected":"Sites running the 2Way VideoCalls and Random Chat WordPress plugin at version 6.1.9 or earlier are in scope. The sources do not describe which actions are exposed or which roles can reach them, so sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","webcam2wayvideochat","wordpress"],"campaign_type":null,"search_a":"'-120857':12A,15A '-2026':11A,14A '2way':2A '6.1.9':9A 'author':6A 'check':7A 'cve':10A,13A 'miss':5A 'plugin':4A 'videocal':3A 'wordpress':1A","search_b":"'2way':19B,23B 'access':39B 'action':47B 'allow':52B 'attack':44B 'author':33B 'chat':27B 'check':34B 'control':40B 'function':37B 'lack':31B 'may':45B 'misconfigur':42B 'packag':16B 'perform':54B 'plugin':30B 'random':26B 'reach':46B 'videocal':24B 'videochat':20B 'webcam':18B,29B 'webcam-2way-videochat':17B 'wordpress':21B,28B","search_c":"'2way':60C,67C,79C '6.1.9':87C 'access':73C 'affect':78C 'allow':69C 'author':56C 'chat':64C,83C 'configur':72C 'control':74C 'exploit':70C 'incorrect':71C 'issu':77C 'levels.this':76C 'miss':55C 'n/a':85C 'random':63C,82C 'secur':75C 'videocal':61C,80C 'videochat':68C 'videowhisper.com':59C 'vulner':57C 'webcam':66C 'webcam-2way-videochat':65C","first_public_at":"2026-11-07T11:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120857","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120857","severity":null,"published_at":"2026-11-07T11:17:00+00:00","modified_at":"2026-11-07T11:17:00+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","fetched_at":"2026-11-07T11:46:53+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}