9.8Kritisch

CVE-2025-31380WordPress Paid Videochat Turnkey Site plugin <= 7.3.11 - Broken Authentication Vulnerability

videowhisper Paid Videochat Turnkey Site Veröffentlicht: 2025-04-17 18:47 (vor 1 Jahr)

Beschreibung

Weak Password Recovery Mechanism for Forgotten Password vulnerability in videowhisper Paid Videochat Turnkey Site ppv-live-webcams allows Password Recovery Exploitation.This issue affects Paid Videochat Turnkey Site: from n/a through <= 7.3.11.

Schwachstellentyp (CWE): CWE-640

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
videowhisper	Paid Videochat Turnkey Site	≤ 7.3.11

Referenzen und Patches

https://patchstack.com/database/Wordpress/Plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turn… vdb-entry

CVSS-Score

9.8Kritisch

Quelle: Patchstack · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Alle Scores (2)

cna	CVSS 3.1	9.8Kritisch
audit@patchstack.com	CVSS 3.1	9.8Kritisch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.58%

höher als 48 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: yes
Technische Auswirkung: total

Zeitverlauf

ID reserviert2025-03-28
Veröffentlicht2025-04-17 18:47
Bei IP-DB eingegangen2026-10-25 00:02
Zuletzt aktualisiert2026-06-17 12:10

Vergeben von (CNA): Patchstack
NVD-Status: Deferred

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — WordPress plugins & themes

Ohne Score

CVE-2026-126639 vor 1 Stunde

WP Ultimate CSV Importer (Free & Pro) - Unauthenticated Post Data Disclosure via Predictable Single Export Path

WP Ultimate CSV Importer; WP Ultimate CSV Importer Pro

The WP Ultimate CSV Importer WordPress plugin before 9.2, WP Ultimate CSV Importer Pro WordPress plugin before 9.0.7 do not protect the files created by their single post export feature, writing them to a publicly accessible location under a predictable name…

Ohne Score

CVE-2026-126640 vor 1 Stunde

WP Ultimate CSV Importer < 9.3 - Admin+ SQLi via LifterLMS Import

WP Ultimate CSV Importer

The WP Ultimate CSV Importer WordPress plugin before 9.3 does not escape values from imported files before using them in SQL queries when importing LifterLMS content, allowing high privilege users such as admin, including the administrator of a single site o…

Ohne Score

CVE-2026-126697 vor 1 Stunde

Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel

Quick Page/Post Redirect Plugin

The Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 was distributed with a hidden update mechanism that fetched Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 updates from its author's own server instead of WordPress.org, which wa…

Ohne Score

CVE-2026-118182 vor 1 Stunde

Copy & Delete Posts < 1.5.8 - Authenticated Arbitrary Post Slug Takeover

Duplicate Post

The Duplicate Post WordPress plugin before 1.5.8 does not check that a user duplicating a post is allowed to edit it, which, when the slug takeover option is enabled, allows users of a role an administrator has given Duplicate Post WordPress plugin before 1.5…

Ohne Score

CVE-2026-118183 vor 1 Stunde

Copy & Delete Posts < 1.5.8 - Authenticated Post Publishing Restriction Bypass

Duplicate Post

The Duplicate Post WordPress plugin before 1.5.8 does not check whether a user may publish posts when duplicating one, allowing users of a role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, such as Contributors, to create …

Ohne Score

CVE-2026-119258 vor 1 Stunde

Swipe <= 1.4 - Unauthenticated Authentication Bypass

Swipe

The Swipe WordPress plugin through 1.4 does not properly authenticate a login request before issuing a WordPress session cookie, allowing unauthenticated attackers to log in as an existing user, including an administrator, when that user has an active app session.