{"id":"CVE-2026-124414","kind":"vulnerability","aliases":["CVE-2026-124414"],"related":[],"title":"Broadcast Live Video WordPress plugin: weak authentication lets attackers abuse access","description":"Weak Authentication vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Authentication Abuse.This issue affects Broadcast Live Video: from n/a through 7.3.15.","summary":"The Broadcast Live Video plugin (videowhisper-live-streaming-integration) for WordPress has a weak authentication flaw affecting versions through 7.3.15. Per the NVD description, an attacker can abuse authentication to gain access they should not have.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["broadcast-live-video","package","videowhisper","wordpress"],"not_affected_if":[],"how_to_check":"- Check the installed version of the Broadcast Live Video plugin (videowhisper-live-streaming-integration) in the WordPress admin plugin list, and compare it with `7.3.15`.","fix":null,"status":"open","published_at":"2026-11-13T15:17:36+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","triaged_at":"2026-11-13T15:50:05+00:00","updated_at":"2026-11-13T15:50:05+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-13T15:50:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Broadcast Live Video WordPress plugin: weak authentication lets attackers abuse access","impact":"medium","summary":"The Broadcast Live Video plugin (videowhisper-live-streaming-integration) for WordPress has a weak authentication flaw affecting versions through 7.3.15. Per the NVD description, an attacker can abuse authentication to gain access they should not have.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","broadcast-live-video","videowhisper"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to plugin functions through weak authentication","analyst_note":"Find the vendor advisory or a fixed plugin version and the exact authentication weakness at the NVD link: https://nvd.nist.gov/vuln/detail/CVE-2026-124414","how_to_check":"- Check the installed version of the Broadcast Live Video plugin (videowhisper-live-streaming-integration) in the WordPress admin plugin list, and compare it with `7.3.15`.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running the Broadcast Live Video WordPress plugin at version 7.3.15 or earlier are in the affected range per NVD. The sources do not say which configuration or features are needed to be exposed, or whether authentication is required first. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4545,"output_tokens":555,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124414':14A,17A '-2026':13A,16A '7.3.15':45B,82C 'abus':10A,53B 'abuse.this':73C 'access':11A,57B 'affect':42B,75C 'allow':71C 'attack':9A,51B 'authent':7A,40B,54B,59C,72C 'broadcast':1A,19B,26B,63C,76C 'broadcast-live-video':18B 'cve':12A,15A 'descript':49B 'flaw':41B 'gain':56B 'integr':34B,70C 'issu':74C 'let':8A 'live':2A,20B,27B,32B,64C,68C,77C 'n/a':80C 'nvd':48B 'packag':22B 'per':46B 'plugin':5A,29B 'stream':33B,69C 'version':43B 'video':3A,21B,28B,65C,78C 'videowhisp':23B,31B,67C 'videowhisper-live-streaming-integr':30B,66C 'videowhisper.com':62C 'vulner':60C 'weak':6A,39B,58C 'wordpress':4A,24B,36B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Broadcast Live Video WordPress plugin at version 7.3.15 or earlier are in the affected range per NVD. The sources do not say which configuration or features are needed to be exposed, or whether authentication is required first. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["broadcastlivevideo","medium","package","videowhisper","wordpress"],"campaign_type":null,"search_a":"'-124414':14A,17A '-2026':13A,16A 'abus':10A 'access':11A 'attack':9A 'authent':7A 'broadcast':1A 'cve':12A,15A 'let':8A 'live':2A 'plugin':5A 'video':3A 'weak':6A 'wordpress':4A","search_b":"'7.3.15':45B 'abus':53B 'access':57B 'affect':42B 'attack':51B 'authent':40B,54B 'broadcast':19B,26B 'broadcast-live-video':18B 'descript':49B 'flaw':41B 'gain':56B 'integr':34B 'live':20B,27B,32B 'nvd':48B 'packag':22B 'per':46B 'plugin':29B 'stream':33B 'version':43B 'video':21B,28B 'videowhisp':23B,31B 'videowhisper-live-streaming-integr':30B 'weak':39B 'wordpress':24B,36B","search_c":"'7.3.15':82C 'abuse.this':73C 'affect':75C 'allow':71C 'authent':59C,72C 'broadcast':63C,76C 'integr':70C 'issu':74C 'live':64C,68C,77C 'n/a':80C 'stream':69C 'video':65C,78C 'videowhisp':67C 'videowhisper-live-streaming-integr':66C 'videowhisper.com':62C 'vulner':60C 'weak':58C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124414","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124414","severity":null,"published_at":"2026-11-13T15:17:36+00:00","modified_at":"2026-11-13T15:17:37+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","fetched_at":"2026-11-13T15:46:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}