---
id: "CVE-2026-120857"
page: "https://infrastack.ai/live/CVE-2026-120857"
kind: "vulnerability"
aliases: ["CVE-2026-120857"]
title: "WordPress 2Way VideoCalls plugin: missing authorization check through 6.1.9"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "webcam-2way-videochat", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-07T11:17:00+00:00"
first_seen_at: "2026-11-07T11:46:53+00:00"
updated_at: "2026-11-07T11:48:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120857", "first_seen_at": "2026-11-07T11:46:53+00:00"}]
exploit_sources: []
---

# WordPress 2Way VideoCalls plugin: missing authorization check through 6.1.9

Link for people: https://infrastack.ai/live/CVE-2026-120857 (this .md is for agents)

The 2Way VideoCalls and Random Chat WordPress webcam plugin lacks an authorization check on some functionality. Because access control is misconfigured, an attacker may reach actions they should not be allowed to perform.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `webcam-2way-videochat` plugin is installed on your WordPress site and note its version.
- Compare the installed version against `6.1.9`; versions through `6.1.9` are listed as affected.

## Timeline

- 2026-11-07T11:46:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120857

## From the sources

Missing Authorization vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.9.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_