CVE-2026-107426: Missing Authorization in VideoWhisper.com Paid Videochat Turnkey Site

This vulnerability in VideoWhisper.com Paid Videochat Turnkey Site (ppv-live-webcams) arises from missing authorization checks caused by misconfigured access control security levels. It affects all versions prior to 7.5.13. The CVSS 3.1 vector indicates that an attacker can exploit this remotely without privileges or user interaction, potentially leading to limited confidentiality, integrity, and availability impacts. No known exploits are reported in the wild, and no official patch or vendor advisory details are available at this time.

The vulnerability allows unauthorized remote attackers to bypass access controls, potentially leading to unauthorized information disclosure, modification, or disruption of service. The impact is rated as low on confidentiality, integrity, and availability but is considered high severity overall due to ease of exploitation and lack of required privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and strengthen access control configurations to ensure proper authorization enforcement. Monitor for updates from VideoWhisper.com regarding patches or official mitigations.