# CVE-2026-108476: VideoWhisper Paid Videochat Turnkey Site broken access control

Source: https://junglewise.ai/threats/cve-2026-108476-missing-authorization-vulnerability-in-videowhisper-com-paid  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108476 · Severity: medium · CVSS 5 · Published 2026-10-12

The Paid Videochat Turnkey Site is a WordPress plugin that powers pay-per-view video streaming platforms. A broken access control vulnerability allows users to access pages and perform actions they should not be authorized for, such as viewing other users' private data or content. An attacker with a subscriber account could potentially view restricted content or manipulate data belonging to other users.

Technologies: [VideoWhisper Paid Videochat Turnkey Site](https://junglewise.ai/threats/technologies/paid-videochat-turnkey-site). Vendors: [VideoWhisper](https://junglewise.ai/threats/vendors/videowhisper).

## Quick answers

**Is CVE-2026-108476 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108476 being exploited in the wild.

**How severe is CVE-2026-108476?** Medium severity, with a CVSS score of 5, published 12 October 2026.

**Which products and versions are affected?** VideoWhisper Paid Videochat Turnkey Site up to 7.5.13.

**Is there a fix for CVE-2026-108476?** Yes: fixed in 7.5.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108476 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-108476?** Check whether you run VideoWhisper Paid Videochat Turnkey Site at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.5.14

## Technical details

The plugin fails to properly enforce authorization checks on sensitive operations, allowing authenticated users with subscriber-level privileges to access restricted resources. The vulnerability exists in versions up to 7.5.13 and is exploited via network access with low privileges. A fix is available in version 7.5.14.

## Affected products

- VideoWhisper Paid Videochat Turnkey Site up to 7.5.13

## Timeline

- 2026-10-09: disclosed
- 2026-10-12: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-plugin-7-5-13-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-plugin-7-5-13-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [VideoWhisper Paid Videochat Turnkey Site arbitrary file deletion](https://junglewise.ai/threats/cve-2026-57331-videowhisper-paid-videochat-turnkey-site-arbitrary-file-deletion)
- [VideoWhisper Paid Videochat Turnkey Site deserialization of untrusted data](https://junglewise.ai/threats/cve-2026-27333-videowhisper-paid-videochat-turnkey-site-deserialization-of)
- [VideoWhisper Paid Videochat Turnkey Site missing authorization](https://junglewise.ai/threats/cve-2026-24590-videowhisper-paid-videochat-turnkey-site-missing-authorization)