Is CVE-2026-24590 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24590 being exploited in the wild.

How severe is CVE-2026-24590?

Medium severity, with a CVSS score of 5.3, published 26 May 2026.

Which products and versions are affected?

VideoWhisper Paid Videochat Turnkey Site <= 7.3.23.

Is there a fix for CVE-2026-24590?

A patch was published on 2026-05-26: Version 7.3.24 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-24590 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-24590?

Check whether you run VideoWhisper Paid Videochat Turnkey Site at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24590: VideoWhisper Paid Videochat Turnkey Site missing authorization

Q: Is there a fix for CVE-2026-24590?

A patch was published on 2026-05-26: Version 7.3.24 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-24590 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-24590?

Check whether you run VideoWhisper Paid Videochat Turnkey Site at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24590 · Severity: medium · CVSS 5.3 · Published 2026-05-26

The VideoWhisper Paid Videochat Turnkey Site plugin for WordPress, which provides platforms for premium webcam services, contains a security flaw in its access control settings. This vulnerability allows unauthorized users to bypass intended security levels, potentially accessing features or information that should be restricted to paying members or administrators. While the impact is considered moderate, it could lead to unauthorized use of the service or exposure of internal site configurations.

Technologies: VideoWhisper Paid Videochat Turnkey Site. Vendors: VideoWhisper.

Quick answers

Is CVE-2026-24590 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24590 being exploited in the wild.
How severe is CVE-2026-24590?: Medium severity, with a CVSS score of 5.3, published 26 May 2026.
Which products and versions are affected?: VideoWhisper Paid Videochat Turnkey Site <= 7.3.23.
Is there a fix for CVE-2026-24590?: A patch was published on 2026-05-26: Version 7.3.24 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24590 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-24590?: Check whether you run VideoWhisper Paid Videochat Turnkey Site at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Broken Access Control vulnerability (CWE-862) exists in the VideoWhisper.Com Paid Videochat Turnkey Site plugin for WordPress through version 7.3.23. The flaw stems from missing authorization checks in functions responsible for enforcing security levels, allowing unauthenticated remote attackers to bypass intended access restrictions. According to the CVSS vector, the attack is low complexity and requires no user interaction, though the impact is limited to a partial loss of confidentiality. The issue is resolved in version 7.3.24.

Affected products

VideoWhisper.com Paid Videochat Turnkey Site <= 7.3.23

Timeline

2025-12-17: other: Reported by researcher ChuongVN
2026-05-26: advisory: Published by Patchstack and NVD
2026-05-26: patched: Version 7.3.24 released to address the issue

References

https://patchstack.com/database/wordpress/plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-plugin-7-3-23-broken-access-control-vulnerability-2?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.