This vulnerability in videowhisper Paid Videochat Turnkey Site versions up to 7.3.11 is due to a weak password recovery mechanism for forgotten passwords. The flaw allows an unauthenticated attacker to exploit the password recovery process, potentially leading to complete compromise of user accounts and system integrity. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting the critical nature of the issue with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation could allow an attacker to fully compromise user accounts by bypassing or manipulating the password recovery process, resulting in complete loss of confidentiality, integrity, and availability of affected systems and data. This could lead to unauthorized access, data theft, and service disruption within the videowhisper Paid Videochat Turnkey Site environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, users should consider restricting access to the password recovery functionality or implementing additional verification controls if possible.