Executive brief
WpStream is a WordPress plugin used for live streaming and video-on-demand services. A security flaw in the plugin allows logged-in users to bypass intended access controls, potentially allowing them to modify data or interact with resources they should not have permission to access. This could lead to unauthorized changes to streaming configurations or site content.
Technical details
The WpStream plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The flaw exists because the application does not sufficiently validate the identity of a user against the resource they are attempting to access or modify. An attacker with a low-privileged account (such as a Subscriber) can manipulate input keys to bypass access control security levels. This can result in unauthorized integrity changes or service disruptions. The issue is resolved in version 4.11.2.
Affected products
- wpstream WpStream < 4.11.2
Timeline
- 2026-02-09: other: Vulnerability reported by researcher
- 2026-03-11: advisory: Patchstack advisory published
- 2026-04-08: disclosed: CVE published to NVD
- 2026-04-08: patched: Fix available in version 4.11.2